> For the complete documentation index, see [llms.txt](https://proinsight.gitbook.io/crewmeld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://proinsight.gitbook.io/crewmeld/crewmeld-user-manual.md).

# CrewMeld user manual

> Version 1.0.0

***

## 0. System Initialization

> This section applies only to a fresh deployment. Once initialization completes, this page automatically redirects to the login page; revisiting `/setup` thereafter redirects to `/dashboard`.

After deploying CrewMeld for the first time, the platform's root URL routes to the initialization wizard at `/setup`. You cannot sign in until the first super admin and workspace are created. The `/api/system/setup/status` endpoint determines whether initialization has been completed.

### 0.1 Three-Step Wizard

{% stepper %}
{% step %}

### Admin Account

| Field                | Required | Description                               |
| -------------------- | -------- | ----------------------------------------- |
| **Admin Name**       | Yes      | Shown in the navigation bar and audit log |
| **Admin Email**      | Yes      | Email format validation                   |
| **Password**         | Yes      | Minimum 8 characters                      |
| **Confirm Password** | Yes      | Must match the password                   |

Click **"Next"** after validation passes to enter org configuration.
{% endstep %}

{% step %}

### Organization

| Field                 | Required | Description                                        |
| --------------------- | -------- | -------------------------------------------------- |
| **Organization Name** | No       | Defaults to a system-generated value if left blank |
| {% endstep %}         |          |                                                    |

{% step %}

### System Check

The wizard verifies database, Redis, and other key dependencies and shows the result. Click **"Finish"** to call `/api/system/setup` and submit initialization.
{% endstep %}
{% endstepper %}

### 0.2 After Initialization

* The platform creates the super admin account and the default workspace.
* You are redirected to `/login`. Use the admin email and password you just entered.
* The first account is automatically granted **Super Admin** and bypasses all permission checks.

> **Note:** Initialization is a one-time operation. To run the wizard again you must reset the database.

***

## 1. Sign In & Registration

![Sign In Page](/files/ad10c1eb52c60ba94e67866e24ea54d4ae2826e8)

### 1.1 Sign In

Upon opening the platform URL you will be taken to the sign-in page. The left side showcases the platform's core features (enterprise-grade security, intelligent automation, flexible orchestration), while the right side contains the sign-in form.

1. Enter your registered email address in the **Email** field.
2. Enter your password in the **Password** field (click the eye icon on the right to toggle password visibility).
3. Click the **"Sign In"** button.
4. After a successful sign-in you will be automatically redirected to the Dashboard.

### 1.2 Register a New Account

Registration is split into several dedicated pages.

#### 1.2.1 Submit the Sign-up Form (`/signup`)

{% stepper %}
{% step %}

### Open the sign-up page

Click the **"Register Now"** link on the login page to open `/signup`.
{% endstep %}

{% step %}

### Fill in the form

| Field                | Required | Description                                                                      |
| -------------------- | -------- | -------------------------------------------------------------------------------- |
| **Display Name**     | Yes      | Shown in the navigation bar and conversations                                    |
| **Email**            | Yes      | Must satisfy the registration policy configured by the administrator (see §14.5) |
| **Password**         | Yes      | Minimum 8 characters                                                             |
| **Confirm Password** | Yes      | Must match the password                                                          |
| {% endstep %}        |          |                                                                                  |

{% step %}

### Submit registration

Click **"Register"** to submit.
{% endstep %}

{% step %}

### Follow the configured routing

After submission the platform routes you based on administrator configuration:

* Email verification enabled → wait-for-verification page
* Approval required → `/pending-approval`
* No gating → automatic sign-in and redirect to the dashboard
  {% endstep %}
  {% endstepper %}

#### 1.2.2 Email Verification (`/verify`)

If email verification is enabled:

1. The platform sends a verification email to the registered address.
2. Click the link in the email; it points to `/verify?token=...`.
3. The page validates the token automatically and shows the result. On failure it displays the reason and offers a resend button.

#### 1.2.3 Awaiting Approval (`/pending-approval`)

If administrator approval is required:

* The page shows "Your account is awaiting administrator approval, please try again later".
* Once an administrator approves under **System Settings → User Management**, you can sign in with the email and password you registered.
* If the request is rejected, the page shows "Approval not granted" along with any administrator note.

### 1.3 Forgot Password (`/reset-password`)

{% stepper %}
{% step %}

### Request a reset link

Click the **"Forgot Password?"** link above the password field.
{% endstep %}

{% step %}

### Submit your email

Enter your registered email address and click **"Send reset link"**.
{% endstep %}

{% step %}

### Use the reset link

The system sends a reset link pointing to `/reset-password?token=...`.
{% endstep %}

{% step %}

### Set a new password

On the reset page, enter and confirm the new password; on submit you are redirected back to the login page.
{% endstep %}
{% endstepper %}

> **Note:** Reset links expire after a short window — request a new one if it has expired.

***

## 2. Dashboard

![Dashboard](/files/b5997646e1d3e36a708905e158ac96e499072785)

After signing in you land on the Dashboard by default, which provides a global view of the platform's operational status.

### 2.1 Key Metrics

Four metric cards are displayed at the top of the page:

| Metric               | Description                                                                                                          |
| -------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Active Employees** | Number of Digital Employees currently running; standby count shown below                                             |
| **Monthly Tasks**    | Total tasks executed in the current month; a red/green arrow indicates the percentage change from the previous month |
| **Success Rate**     | Task success rate for the current month; highlighted in red when below the threshold                                 |
| **Pending Items**    | Number of items requiring manual approval or intervention, including SOP approvals, etc.                             |

### 2.2 Asset Overview

Three cards display the configured assets:

* **Tools** — Number of deployed and bound Tools
* **Knowledge Base** — Total number of Knowledge Bases and bound count
* **System Connections** — Number of configured external System Connections

### 2.3 SOP Execution Statistics

Displays the current month's SOP execution summary: number of SOP definitions, completed, in progress, failed, and pending approval. Pending approval items are highlighted in red.

### 2.4 Conversation Statistics

Displays the current month's total conversations, total messages, and active channel count, broken down by channel type (Discord, Telegram, Web, etc.).

### 2.5 7-Day Task Trend

A line chart showing the daily task execution volume over the past 7 days. Hover over a data point to see the exact value.

### 2.6 Employee Performance Ranking

A table ranking Digital Employees by task count and success rate, allowing you to quickly identify top performers.

### 2.7 System Status

Cards displaying system operational status, including:

* **Version** — Current system version
* **Database** — Connection status and response latency
* **Redis** — Connection status and response latency
* Health status of other infrastructure components

***

## 3. Digital Employees

![Digital Employee List](/files/f329e94984674bc1922fbb334c4734b033b1cfac)

Digital Employees are the core concept of the platform. Each Digital Employee is an independently running AI agent bound to a specific model, Knowledge Base, and Tools.

### 3.1 Viewing the Employee List

On the **Digital Employees** page, all Digital Employees are displayed in a card grid. Each card contains:

| Field                       | Description                                                      |
| --------------------------- | ---------------------------------------------------------------- |
| **Employee Name**           | Name of the employee; click to enter the detail page             |
| **Description**             | Description of the employee's responsibilities                   |
| **Today's Tasks**           | Real-time count of the day's completed work                      |
| **Success Rate**            | Task success rate as a percentage                                |
| **Bound Model**             | Name of the currently bound LLM model (shown when bound)         |
| **Knowledge Base Bindings** | Number of associated Knowledge Bases (shown when greater than 0) |

### 3.2 Search

* **Search Box** — Enter keywords to perform real-time fuzzy search by name

### 3.3 Creating a Digital Employee (Five-Step Wizard)

Click the **"Onboard New Employee"** button in the upper-right corner to launch the five-step creation wizard:

![Create Employee - Basic Settings](/files/0f32534cb095e72fda24bf93970c941ad81ff3b1)

{% stepper %}
{% step %}

### Basic Settings

| Field              | Required | Description                                                                                                                                                                                        |
| ------------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Avatar**         | No       | 8 quick emoji buttons are provided; click "More" to open the full emoji picker (8 categories: People, Robots, Business, Data, Tools, Creative, Communication, Other — hundreds of emojis in total) |
| **Employee Name**  | Yes      | Up to 50 characters                                                                                                                                                                                |
| **Description**    | No       | Up to 200 characters                                                                                                                                                                               |
| **Persona**        | No       | Multi-line text defining the employee's role positioning, personality traits, and response style                                                                                                   |
| **Role Selection** | No       | Click the button to open the role selection dialog, where you can choose from built-in roles or create a custom role                                                                               |

**Role Selection Dialog:**

* All roles are displayed as a card list grouped by category: Sales, Data, Service, plus your custom roles
* Each card shows the role icon, name, and description
* Built-in roles cannot be deleted; custom roles display a delete button on hover
* Click the **"Create Role"** button to create a new custom role (requires name, description, and persona)
* Selecting a role auto-fills the **employee name, description, and persona** fields with the role's defaults — only when the user has not yet manually edited those fields

**Built-in roles (15 total):**

| Category        | Roles                                                                                                                        |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Sales (5)**   | Lead Researcher, SDR (Sales Development Rep), Lead Scorer, CRM Data Entry Specialist, Sales Coach                            |
| **Data (4)**    | Query Analyst, Chart Generator, Report Writer, Anomaly Detector                                                              |
| **Service (6)** | Reception Router, Pre-Sales Consultant, After-Sales Specialist, Quality Inspector, Human Handoff Coordinator, Q\&A Assistant |

> **Tip:** Built-in role IDs are prefixed with `builtin-` and live in front-end static data — they are not stored in the database. The server rejects attempts to delete a built-in role.
> {% endstep %}

{% step %}

### Configure Tools

* All deployed tool instances are displayed in a 3-column card grid, 9 per page
* Each tool card shows: icon, name, description, source template
* Click a card to select/deselect; selected items display a blue border and checkmark
* The number of selected items is shown at the bottom
* Pagination is supported for browsing
  {% endstep %}

{% step %}

### Configure Knowledge Base

* All available Knowledge Bases are displayed in a 2-column card grid
* Each card shows: checkbox, name, description, document count, Chunks count
* A blue info box explains that Knowledge Base configuration is optional
* Check the checkbox to select/deselect
  {% endstep %}

{% step %}

### Bind Model

* A search box is provided to filter by model display name, provider name, or model name
* All activated model configurations are displayed in a list
* Each item shows: provider icon, display name, provider name, model name
* Select one model via radio button (single selection)
* A blue info box explains that model configuration is optional
  {% endstep %}

{% step %}

### Test Run

* Click the **"Run Test"** button to execute a test with empty input
* On success, a green checkmark and the returned message are displayed
* On failure, a red cross and the error message are displayed
* Click the **"Re-run"** button to repeat the test
* Execution logs can be expanded for viewing if available
  {% endstep %}
  {% endstepper %}

### 3.4 Viewing Employee Details

Click an employee card's name to enter the detail page, which contains the following sections:

![Employee Detail Page](/files/209f58e07efd7f5744b5e709c67f93d63f58ad1c)

#### Page Header

* Employee avatar and name
* Employee ID (first 8 characters displayed; click to copy the full ID)
* Days on duty, description

**Action Buttons:**

* **Delete** — Red trash icon; clicking opens a confirmation dialog

#### Tabs

**(1) Overview Tab**

Statistic cards (with monthly/weekly/daily period toggle):

| Metric                  | Description                                  |
| ----------------------- | -------------------------------------------- |
| Completed Tasks         | Total tasks completed in the selected period |
| Success Rate            | Displayed as a percentage                    |
| Average Duration        | Formatted display                            |
| Pending Approvals       | Highlighted as a warning when greater than 0 |
| Error Count             | Highlighted as a warning when greater than 0 |
| Knowledge Base Bindings | Number of bound Knowledge Bases              |
| Bound Model             | Name of the currently bound model            |

Below the cards is a recent activity log list. Each log entry shows a timestamp, type label (Action / Decision / Tool Call / LLM Call / Error), and message content.

**(2) Work Logs Tab**

* **Date Filter** — All / Today / This Week / This Month
* **Type Filter** — All / Action / Tool Call / LLM Call / Error
* Logs are grouped by task ID; each task group can be expanded/collapsed
* Each task group header shows: trigger type, status label, duration, error flag, input summary
* Expand to view each log entry within the task: timestamp, type label, message content
* Each log entry can be clicked to expand and view metadata JSON
* Pagination is supported when there are more than 50 log entries
* A **"Refresh"** button in the upper-right corner allows manual updates

**(3) Tool Bindings Tab**

**Bound Instances Section:**

* Displays the heading and bound count
* Each bound tool shows: name, source template, status (Deployed), endpoint address
* Each tool has an **"Unbind"** button (red) on the right

**Adding Tools:**

1. Click the **"Add Tool"** button
2. The available instances list expands; each instance has a **"Bind"** button (blue) on the right
3. Clicking bind automatically adds it to the bound list

**(4) Knowledge Base Tab**

> **Prerequisite**: A RAGFlow Knowledge Base connection must first be configured under **System Connections**. If not configured, a prompt message and a **"Go to Configure Knowledge Base Connection"** button are displayed, which navigates to the RAGFlow tab on the System Connections page.

**Bound Knowledge Bases Section:**

* Displayed in a 3-column card grid
* Each card shows: icon, name, description, document count, Chunks count
* An **"Unbind"** button (trash icon) appears on hover

**Binding a Knowledge Base:**

1. Click the **"Bind"** button
2. A Knowledge Base selection dialog appears, showing the list of available Knowledge Bases
3. Each Knowledge Base has a **"Bind"** button on the right
4. Clicking bind automatically adds it to the bound list
5. When all Knowledge Bases are already bound, "All Bound" is displayed

**(5) Connection Management Tab**

Two sections for managing the employee's external connections:

**LLM Model Binding:**

* When bound: displays a model card (provider icon, display name, provider, model name, status) with **"Edit"** and **"Unbind"** buttons
* When unbound: displays an empty state; click the **"Bind Model"** button to open the model selection dialog
* The model selection dialog provides a search box and model list with name filtering

**Message Channels:**

* Bound channels are displayed in a list with blue borders; each channel can be **"Unbound"**
* Available channels are displayed in a list with white borders; each channel can be **"Bound"**

Each channel item shows: icon, name, type, status indicator (green = connected, red = error, gray = not connected), description.

**(6) Persona Settings Tab**

Edit the employee's Persona Settings, defining role positioning, personality traits, and response style.

* **Text Editor** — Multi-line text input for freely editing the persona description
* **Quick Templates** — Four preset template buttons: Customer Service Agent, Data Analyst, Sales Assistant, General Assistant; click to quickly populate
* **Preview/Edit Toggle** — Switch between edit mode and Markdown preview mode
* **Token Estimate** — Real-time display of the estimated Token consumption for the current persona description (budget: 1000 Tokens)
* **Character Count** — Displays the current input character count
* **Save Button** — Click to save changes; a checkmark is displayed on success

### 3.5 Deleting a Digital Employee

**Delete from the List:**

1. Click the **trash icon** in the upper-right corner of the card
2. Click **"Confirm Delete"** in the confirmation dialog

**Delete from the Detail Page:**

1. Click the red **trash icon** in the page header
2. Click **"Confirm Delete"** in the confirmation dialog

> **Note**: Deletion is irreversible.

***

## 4. Task Center

![Task Center](/files/2b7f837363b5d3a7f752c7ddfdb02bbf45a3bb56)

The Task Center centrally manages the full lifecycle of all SOP execution tasks. A red badge (e.g., 99+) next to the Task Center icon in the sidebar indicates the number of pending tasks.

### 4.1 In Progress Tab

Displays tasks currently being executed or awaiting approval. A green "Auto-refreshing" indicator appears at the top of the page, with task statuses updating in real time.

**Task List Fields:**

| Column            | Description                                                                                        |
| ----------------- | -------------------------------------------------------------------------------------------------- |
| **SOP Name**      | The name and version number of the SOP that triggered the task (e.g., "Procurement Equipment v28") |
| **Status**        | Current status label: Pending, Running, Pending Manual Approval (blue), etc.                       |
| **Node Progress** | Completed nodes / total nodes (e.g., 1/2)                                                          |
| **Current Node**  | Name of the node currently being executed or awaited                                               |
| **Triggered By**  | The user or system that triggered the task                                                         |
| **Duration**      | Cumulative time elapsed from start to present                                                      |
| **Time**          | Relative time since task creation (e.g., "14 hours ago")                                           |

**View Task Details:**

Click any task row to open the task detail drawer on the right (520px wide), which contains:

1. **Basic Information** (two-column grid):
   * SOP name + version number
   * Triggered By
   * Created time, start time, completion time
   * Duration (with clock icon)
   * Node progress (completed/total)
   * Retry count (shown when greater than 0)
2. **Error Information** (red area): Only displayed when the task has an error, showing the full error text
3. **Node Execution Timeline**:
   * Displays the execution status of each node along a vertical timeline
   * Each node shows: status icon (Pending/Running/Completed/Skipped/Error), node name, type label, start time, duration
   * Failed nodes display a red error message
4. **Trigger Data**: Displays the input data at the time of triggering in JSON format

### 4.2 Scheduled Tasks Tab

![Scheduled Tasks](/files/2f9cc13f6c426f0a8774231d091546a2c3dca8a1)

Manage tasks that are triggered on a schedule via Cron.

**Scheduled Task List Fields:**

| Column        | Description                                           |
| ------------- | ----------------------------------------------------- |
| **Task Name** | Name of the scheduled task                            |
| **SOP Name**  | Associated SOP name                                   |
| **Schedule**  | Cron expression (displayed in monospace font)         |
| **Next Run**  | Relative time until the next run (e.g., "in 3 hours") |
| **Status**    | Enabled (green) / Disabled (gray)                     |
| **Actions**   | Edit, Run Now, Enable/Disable, Delete                 |

#### Create a Scheduled Task

{% stepper %}
{% step %}

### Open the creation form

Click the **"+ New Scheduled Task"** button to open a form dialog (520px wide):
{% endstep %}

{% step %}

### Fill in the fields

| Field              | Required | Description                                                               |
| ------------------ | -------- | ------------------------------------------------------------------------- |
| **Task Name**      | Yes      | Text input                                                                |
| **Select SOP**     | Yes      | Dropdown to select an existing SOP                                        |
| **Execution Time** | Yes      | Preset schedule dropdown + custom Cron input                              |
| **Timezone**       | Yes      | Default Asia/Shanghai; options include Asia/Tokyo, UTC, America/New\_York |

**Preset Schedules:**

* Daily at 9:00
* Daily at 18:00
* Weekdays at 9:00
* Every Monday at 9:00
* 1st of every month at 9:00
* Every hour
* Every 30 minutes
* Custom (enter a Cron expression)
  {% endstep %}

{% step %}

### Save the scheduled task

After filling in the form, click **"Save"** to create the scheduled task.
{% endstep %}
{% endstepper %}

#### Edit a Scheduled Task

Click the **pencil icon** in the actions column of the task row to open the same form dialog as creation, pre-filled with the current configuration. Click **"Save"** after making changes.

#### Run Now

Click the **play icon** in the actions column of the task row to immediately trigger a one-time SOP execution for the scheduled task, without waiting for the next scheduled time.

#### Enable/Disable a Scheduled Task

Click the **pause/play icon** in the actions column of the task row to toggle the scheduled task between enabled and disabled. Once disabled, it will no longer execute automatically on schedule.

#### Delete a Scheduled Task

Click the **trash icon** in the actions column of the task row, then click **"Confirm Delete"** in the confirmation dialog to permanently delete the scheduled task.

#### View Execution Records

Click a scheduled task row to open the execution records drawer on the right (480px wide), which displays:

* Task name and associated SOP information
* Historical execution record list: each entry shows a status icon (with animation when running), status text, duration, and timestamp

### 4.3 History Tab

![History](/files/2f056ea611d069f9bcc2fb01679922a0928e62ae)

Displays historical tasks that are completed, failed, timed out, or canceled.

**Filter Criteria:**

| Filter                  | Description                                                         |
| ----------------------- | ------------------------------------------------------------------- |
| **Status Multi-select** | Checkbox dropdown: Completed, Failed, Abnormal, Timed Out, Canceled |
| **SOP Dropdown**        | All SOPs or select a specific SOP                                   |
| **Start Date**          | Date picker                                                         |
| **End Date**            | Date picker                                                         |

Task list fields are the same as the In Progress tab, with pagination support (20 items per page).

### 4.4 Sandbox Records Tab

Displays test run records from the sandbox environment. The sandbox is isolated from production tasks: tools are **not** actually invoked, and every external call (HTTP, database write, etc.) is intercepted and logged so users can validate SOP flows without affecting real data.

**Triggering a sandbox run:**

* **From the SOP editor** — Click the "Sandbox dry-run" button in the editor toolbar (next to "Execute"). The current unsaved SOP definition is posted to `/api/sandbox/sop-run` and the result lands in this tab.
* **From tool debugging** — The tool chat tester and single-step invocations also write entries here.

**List Fields:**

| Column              | Description                                         |
| ------------------- | --------------------------------------------------- |
| **Run Type**        | Label display: SOP Run / Tool Invocation            |
| **Status**          | Colored status label                                |
| **Node Count**      | Number of nodes involved                            |
| **Intercept Count** | Number of external calls intercepted by the sandbox |
| **Duration**        | Execution duration                                  |
| **Time**            | Relative timestamp                                  |

Click a row to open the sandbox run detail drawer to view node execution results, the list of intercepted external calls (method, URL, params), execution paths, and token consumption statistics.

> **Tip:** Sandbox runs do not deliver real notifications (Feishu / DingTalk / email approval messages, etc.) and do not write to work logs. For end-to-end testing, use the "Execute" button in the SOP editor to trigger a real run.

### 4.5 Pending Approval Tasks

In the In Progress tab, tasks pending manual approval are highlighted with a blue label.

**Approval Urgency Levels:**

| Level  | Color  | Wait Time      |
| ------ | ------ | -------------- |
| Urgent | Red    | >= 120 minutes |
| High   | Orange | >= 60 minutes  |
| Medium | Yellow | >= 30 minutes  |
| Normal | Green  | < 30 minutes   |

The pending approval list auto-refreshes every 10 seconds, and wait times are updated every 60 seconds.

#### Approval Actions

Click the **"Approval"** button on a pending approval task to open the approval detail dialog (560px wide):

1. **Information Area**: SOP name + version, awaiting node name, triggered by, created time, expiration time (displayed in orange if applicable)
2. **Action Area**:

**Approve:**

1. Click the blue **"Approve"** button
2. Optionally enter remarks (up to 500 characters)
3. Click **"Confirm Approval"** to submit

**Reject:**

1. Click the red **"Reject"** button
2. A rejection reason is required (up to 1,000 characters, marked with a red asterisk as required)
3. Click **"Confirm Rejection"** to submit

For both actions, you can click the **"Cancel"** link to return to the initial state.

***

## 5. Conversations

![Conversations Page](/files/98f0d7f7cd5f214fc737ae3f9830da4380f36dd5)

The Conversations feature enables users to interact with Digital Employees in real time, for testing employee capabilities or daily communication. It supports text messages, file attachments, Knowledge Base citation display, and tool invocation process visualization.

### 5.1 Select an Employee

Upon entering the **Conversations** page, all Digital Employees are displayed in a card grid (single column on mobile, two columns on tablet, three columns on desktop), with the prompt "Select a Digital Employee to start a conversation."

**Each employee card displays:**

| Item                 | Description                                                                                     |
| -------------------- | ----------------------------------------------------------------------------------------------- |
| **Avatar**           | Blue circular background displaying the first character of the employee name or a custom avatar |
| **Name**             | Employee name (single-line truncation)                                                          |
| **Status Indicator** | Green dot = Running, Gray dot = Inactive                                                        |
| **Description**      | Up to two lines; placeholder text shown when no description exists                              |
| **Bound Model**      | Current model name displayed in purple text                                                     |

**Two action buttons on the right side of each card:**

* **Chat Button** (💬 icon) — Click to enter the chat interface with this employee
* **History Button** (🕐 icon) — Click to enter the full conversation history page for this employee

> **Tip**: Inactive employee cards are displayed semi-transparently and cannot initiate conversations.

**Loading State**: 6 skeleton card animations are displayed while the page loads.\
**Empty State**: When no employees exist, a prompt icon and "No employees" message are displayed.

### 5.2 Chat Interface

After clicking the chat button on an employee card, you enter the chat interface with the following layout:

![Chat Interface](/files/83d9fc31a88ab42fc5766baf52b334d0a77c05a1)

* **Top Navigation Bar** — Back button, employee avatar and name
* **Left Sidebar** (visible on desktop only, 64% width) — Conversation history list
* **Right Main Area** — Chat panel

#### 5.2.1 Conversation History Sidebar

The left sidebar displays all historical conversation sessions for the current employee:

**Each session displays:**

* 💬 icon
* Session title (automatically set to the first 50 characters of the first message, single-line truncation)
* Message count label
* Relative time (e.g., "2 hours ago")

**Actions:**

* **Click a session** — Switch to that conversation and load historical messages
* **"+" Button** — Create a new conversation session
* **Delete Button** (shown on hover, always visible on mobile) — Click to open a confirmation dialog; upon confirmation, the conversation and all its messages are permanently deleted

**Filtering Rule**: Only conversations with messages and the currently active conversation are shown.

> **Tip**: The sidebar is not displayed on mobile; the chat panel fills the entire screen.

#### 5.2.2 Send a Message

{% stepper %}
{% step %}

### Enter your message

Type your message in the input box at the bottom.
{% endstep %}

{% step %}

### Send it

Press **Enter** to send the message (press **Shift+Enter** for a line break). Or click the blue **Send Button** on the right to send.
{% endstep %}
{% endstepper %}

**Input Box Features:**

* Auto-expanding height (minimum 1 line, maximum approximately 120px)
* Maximum input of 10,000 characters (server-side validation)
* Input box is disabled during streaming replies or file uploads

**First Message Behavior:**

* If there is no active conversation, the system automatically creates a new conversation session when you send the first message
* The conversation title is automatically set to the first 50 characters of the first message

#### 5.2.3 Send File Attachments

{% stepper %}
{% step %}

### Open the attachment picker

Click the **📎 Attachment Button** to the left of the input box.
{% endstep %}

{% step %}

### Select files

Select one or more files from the file picker that appears (single file maximum 50MB).
{% endstep %}

{% step %}

### Review pending files

Selected files are displayed in the pending area below the input box, with each file showing:

* 📄 File icon
* File name (maximum display width 150px, truncated if exceeded)
* File size (auto-formatted as B/KB/MB)
* **✕ Remove Button** — Click to cancel sending that file
  {% endstep %}

{% step %}

### Send the attachments

Type a message (optional), then click send to send the files along with the message.
{% endstep %}
{% endstepper %}

> **Tip**: The attachment button is disabled during streaming replies or file uploads.

#### 5.2.4 Message Bubble Display

Messages in the chat interface are displayed as bubbles, with different styles for different roles:

**User Messages (right-aligned):**

* Blue background, white text
* Maximum width 85%
* Preserves whitespace and line break formatting
* **Copy Button** appears on hover; a green checkmark is shown after copying

**Assistant Messages (left-aligned):**

* Gray background, dark text
* Maximum width 85%
* Content rendered in Markdown format, supporting:
  * **Code blocks** — Dark gray background, language label in the upper right corner, horizontally scrollable
  * **Inline code** — Pink text, gray background
  * **Tables** — With borders, gray header
  * **Links** — Blue with underline, opens in a new tab on click
  * **Blockquotes** — Blue vertical bar on the left, italic text
  * **Lists** — Standard ordered/unordered lists
* **Blinking cursor** animation at the end during streaming replies
* **Copy Button** appears on hover (not shown during streaming)

**System Messages (centered):**

* Light yellow background, dark yellow text
* Maximum width 600px
* Used for displaying error messages and system notifications

**Tool Messages:**

* Gray background
* Tool name displayed as a prefix (medium gray)
* Content limited to a maximum of 3 lines

#### 5.2.5 File Attachment Display

File attachments in messages are displayed below the message bubble:

**Image Files:**

* Displayed directly as thumbnails (maximum height 192px)
* Rounded border
* Click the image to open the full-size image in a new tab
* Lazy loading supported

**Non-image Files:**

* Displayed as a file entry: 📄 File icon + file name + file size + ⬇ Download icon
* Files in user messages have a blue-toned background
* Files in assistant messages have a white background with gray border
* Click to download the file

#### 5.2.6 Tool Invocation Process Display

When a Digital Employee invokes a tool during a reply, a tool execution indicator bar is displayed between messages:

* **Executing** — Blue background bar showing a spinning loader icon + "Executing {tool name}"
* **Execution Complete** — Blue background bar showing "Executed {tool name}"
* SOP-type executions display a "Standard Operating Procedure" label

An amber progress message bar may also appear during execution, showing engine processing progress.

#### 5.2.7 Knowledge Base Citation Display

When an assistant reply references Knowledge Base content, an expandable **"Citation Sources"** button is displayed below the message:

1. Click the button to expand the citation panel, showing the number of referenced documents and Chunks.
2. Citations are grouped by document, with each document displaying:
   * 📄 Icon + document name
   * Chunk count label
   * Match percentage label
3. Click a document to expand/collapse all Chunks under that document.
4. Each Chunk displays:
   * Document name (truncated)
   * Chunk index number
   * Similarity percentage label
   * Content preview (up to 3 lines)

#### 5.2.8 Streaming Replies and Loading States

* **Waiting for Reply**: While the assistant is thinking, a gray rounded bubble is displayed with "Thinking..." text and a spinning icon
* **Streaming Output**: The assistant's reply is displayed character by character in a streaming fashion, with a blinking cursor at the end
* **Message Polling**: In non-streaming mode, new messages are automatically polled every 5 seconds (to detect SOP completion, approval results, and other asynchronous messages)

#### 5.2.9 Auto-scroll Behavior

* When the viewport is within 80px of the bottom, new messages automatically scroll to the bottom
* When the user is reading historical messages (scroll position far from the bottom), auto-scroll is disabled to avoid interrupting reading

### 5.3 Create a New Conversation

There are two ways to create a new conversation:

1. **Automatic Creation** — When sending the first message to an employee with no active conversation in the chat interface, the system automatically creates a new conversation
2. **Manual Creation** — Click the **"+"** button in the conversation history sidebar on the left to create a new blank conversation session

### 5.4 Delete a Conversation

1. In the conversation history sidebar on the left, hover over the target conversation and click the **trash icon** that appears.
2. A confirmation dialog appears with a prompt message.
3. Click **"Delete"** (red button) to confirm deletion, or click **"Cancel"** to abort.

> **Note**: Deleting a conversation permanently removes the conversation and all its message records. This action cannot be undone.

### 5.5 Conversation History Page

Click the **History Button** (🕐 icon) on an employee card in the employee selection page to enter the full conversation history page for that employee.

#### Page Layout

* **Top**: Back button, employee information, channel filter dropdown
* **Left List** (320px wide on desktop): Conversation session list
* **Right Detail** (remaining width on desktop): Message details for the selected conversation

> **Mobile**: List and detail views are toggled; after selecting a conversation, the detail view is entered, and you can navigate back to the list.

#### Channel Filter

A channel filter dropdown is provided at the top to filter conversations by source channel:

| Channel                 | Icon              | Color    |
| ----------------------- | ----------------- | -------- |
| All Channels            | —                 | —        |
| Web                     | 🌐 Globe          | Blue     |
| Feishu                  | ✈ Send            | Purple   |
| DingTalk                | 📱 Phone          | Sky Blue |
| WeCom                   | 💬 Message        | Green    |
| Telegram                | ✈ Send            | Cyan     |
| Discord                 | 💬 Message Circle | Indigo   |
| Email                   | ✉ Mail            | Orange   |
| WeChat Official Account | 💬 Message        | Emerald  |
| API                     | 🔗 Link           | Gray     |

Switching channels automatically clears the currently selected conversation.

#### Channel Statistics Badge Bar

Below the top area, conversation count statistics for each channel are displayed as colored mini badges arranged in a row.

#### Conversation List

Each conversation displays:

* **Channel Icon** (circular background in the corresponding color)
* **Conversation Title** or default title
* **Channel Label**
* **Sender Name** (if available, the username from an external channel)
* **Message Preview** (truncated)
* **Message Count** + relative time
* **Delete Button** (trash icon)

#### View Conversation Messages

Click a conversation in the left list, and the right detail area displays:

**Information Header:**

* Channel label
* Sender name
* Message count
* Created date

**Message List:**

* All user and assistant messages are displayed as message bubbles (tool and system messages are filtered out)
* Messages are arranged in chronological order
* If there are many messages, a **"Load More"** button appears at the top (loads 50 messages at a time, cursor-based pagination)

**When no conversation is selected**: A large icon and "Please select a conversation to view" prompt text are displayed.

#### Delete a History Conversation

Click the **trash icon** in the conversation list, and after confirmation, the conversation record is permanently deleted.

A green/red Toast notification appears at the top of the page upon success/failure (auto-dismisses after 3 seconds).

### 5.6 Keyboard Shortcuts

| Shortcut          | Function          |
| ----------------- | ----------------- |
| **Enter**         | Send message      |
| **Shift + Enter** | Insert line break |

***

## 6. Analytics

![Analytics](/files/2cd2075b37d3425633383e6c5517a4625180c5b5)

Analytics provides multi-dimensional data analysis views to help managers understand platform operational efficiency.

### 6.1 Time Range Selection

The top-right area of the page provides:

* Quick selection: **Last 7 Days** (default) / **Last 30 Days** / **Last 90 Days**
* Custom date range picker

### 6.2 Performance Overview

The **Performance Overview** tab contains five analysis sub-tabs:

**(1) Key Metrics**

Four metric cards:

| Metric               | Description                                             |
| -------------------- | ------------------------------------------------------- |
| **Total Tasks**      | Total number of tasks within the selected time range    |
| **Success Rate**     | Percentage of successful tasks                          |
| **Error Rate**       | Proportion of failed tasks                              |
| **Active Employees** | Number of Digital Employees with task execution records |

**(2) Task Volume Trend**

Line chart showing daily task volume trends:

* X-axis: Date
* Y-axis: Task count
* Hover to display daily totals and per-employee breakdowns

**(3) Success Rate Trend**

Line chart showing daily success rate trends:

* Y-axis range: 0-100%
* Hover to display success rate, task count, and employee breakdowns

**(4) Error Distribution**

Bar chart showing daily failed task counts:

* Hover to display failed employee breakdowns

**(5) Employee Comparison**

A table comparing the performance of different Digital Employees, with sortable columns.

### 6.3 Usage Cost

![Usage Cost](/files/82a9c9a6805d0d590e9f1b6f6d7480090dce40b4)

The **Usage Cost** tab displays detailed analysis of LLM model invocation counts and Token consumption.

### 6.4 Export Report

Click the **"Export Report"** button in the top-right corner to open the export configuration dialog:

| Setting         | Description                                                                                                 |
| --------------- | ----------------------------------------------------------------------------------------------------------- |
| **Report Type** | Last Month / Last Quarter / Custom                                                                          |
| **Date Range**  | Specify start and end dates when "Custom" is selected; automatically calculated for Last Month/Last Quarter |
| **Format**      | PDF                                                                                                         |

Click the **"Generate"** button to export the report file.

***

## 7. Knowledge Base

![Knowledge Base](/files/4c3103e10b2105f73a6a49faaa08c2fc4b603e6e)

The Knowledge Base is used to store and manage knowledge documents that Digital Employees can retrieve during task execution and conversations. The current release uses **direct RAGFlow mode**: the knowledge list and document management call RAGFlow APIs directly without an intermediate platform layer.

> **Prerequisite:** Configure a RAGFlow service connection under **System Connections → Knowledge Base (RAGFlow)** before using this section (one per workspace). Until then the page shows an empty state with a "Configure now" button.

### 7.1 Viewing the Knowledge Base List

The list page lives at `/knowledge` and displays every dataset in the connected RAGFlow service as a card grid. Each card shows:

* **Knowledge Base Name** — click to open the detail page at `/knowledge/datasets/{id}`
* **Description** — up to two lines displayed
* **Document Count** — number of documents contained
* **Creation Date**

Search by name or description using the search box at the top.

### 7.2 Creating a Knowledge Base

{% stepper %}
{% step %}

### Open the creation dialog

Click the **"+ Add Knowledge Base"** button in the top-right corner to open the creation dialog.
{% endstep %}

{% step %}

### Fill in the fields

| Field                   | Required | Description                                 |
| ----------------------- | -------- | ------------------------------------------- |
| **Knowledge Base Name** | Yes      | Name of the Knowledge Base                  |
| **Description**         | No       | Description of the Knowledge Base's purpose |
| {% endstep %}           |          |                                             |

{% step %}

### Confirm creation

Click **"Confirm"** to create. The request is forwarded directly to RAGFlow to create the corresponding dataset.
{% endstep %}
{% endstepper %}

### 7.3 Viewing Knowledge Base Details

Click a Knowledge Base card to enter the detail page (`/knowledge/datasets/{id}`), which contains:

![Knowledge Base Details](/files/cd890d3239d04fe6f45329927fbe109bfac0a65b)

**Header Information:**

* Knowledge Base name and description
* Total document count
* Total storage size (automatically formatted as GB/MB/KB/B)
* Embedding model used

**Document List (table format):**

| Column             | Description                                                    |
| ------------------ | -------------------------------------------------------------- |
| **Checkbox**       | Select all / individual selection for bulk operations          |
| **File Name**      | Click to view document details                                 |
| **File Size**      | Formatted display                                              |
| **Chunk Count**    | Number of Chunks after document parsing                        |
| **Upload Time**    | Click column header to sort (ascending/descending/default)     |
| **Enabled Status** | Toggle switch for direct control                               |
| **Parsing Status** | Not Started / Running (with progress bar) / Completed / Failed |
| **Actions**        | Menu button                                                    |

**Filtering:**

* File name search (text input, 400ms debounce)
* File extension dropdown filter

### 7.4 Uploading Documents

{% stepper %}
{% step %}

### Open the upload dialog

On the Knowledge Base detail page, click the **"Upload"** button to open the upload dialog.
{% endstep %}

{% step %}

### Add files

Drag and drop files into the upload area, or click the area to browse and select files.
{% endstep %}

{% step %}

### Review upload limits

**Upload Limits:**

* Maximum 32 files per upload
* Maximum total size of 1 GB per upload
* Supported formats: `.pdf`, `.doc`, `.docx`, `.xls`, `.xlsx`, `.ppt`, `.pptx`, `.txt`, `.md`, `.csv`, `.html`, `.htm`, `.json`, `.png`, `.jpg`, `.jpeg`
  {% endstep %}

{% step %}

### Optional parsing

Optional toggle: **"Parse on Upload"** (enabled by default) — automatically starts parsing documents after upload.
{% endstep %}

{% step %}

### Start upload

The file list displays selected files, each with a remove button on the right. Click **"Upload"** to begin uploading.
{% endstep %}
{% endstepper %}

### 7.5 Managing Documents

#### Viewing Document Details

Click the file name to enter the document detail page, which uses a two-panel layout:

* **Left Panel**: File preview
  * Text files: raw text display
  * Markdown: rendered preview
  * PDF: embedded PDF viewer
  * Excel: multi-sheet tabs + table display
  * Other formats: preview not supported message
* **Right Panel**: Document Chunks list
  * Up to 100 Chunks per page
  * Search box for keyword search within Chunks (400ms debounce)
  * Full / Compact view toggle

#### Renaming a Document

Click the **pencil icon** in the document's action column, enter the new file name in the rename dialog, and save.

#### Toggling Document Enabled Status

In the "Enabled Status" column of the document list, click the toggle switch directly. Enabled documents participate in knowledge retrieval; disabled documents do not.

#### Re-parsing Documents

* **Single parse**: Click the **play icon** or "Parse" button in the document's action column
* **Bulk parse**: Select multiple documents, then click the **"Parse"** button in the bulk action bar
* The list auto-refreshes during parsing (1-second interval while running, 10-second interval after completion)

#### Bulk Operations

After selecting one or more documents, a bulk action bar appears at the top:

* **"Enable"** — bulk enable all selected documents
* **"Disable"** — bulk disable all selected documents
* **"Parse"** — bulk re-parse all selected documents
* **"Delete"** — bulk delete all selected documents (confirmation required)

#### Downloading Documents

Click the **download icon** in the document's action column to download the original file locally.

#### Deleting Documents

* **Single delete**: Click the **trash icon** in the document's action column, confirm to delete
* **Bulk delete**: Select multiple documents, click the **"Delete"** button in the bulk action bar, confirm to delete

### 7.6 Deleting a Knowledge Base

On the Knowledge Base list page, click the **delete icon** in the top-right corner of a Knowledge Base card, confirm to delete the entire Knowledge Base and all its documents.

> **Note**: After deleting a Knowledge Base, all associated documents and Chunks data will be permanently lost and cannot be recovered.

***

## 8. System Connections

![System Connections](/files/073433341c16e2e2bfe127a7f67ece669b11f85d)

System Connections manages the integration configuration between the platform and external systems and LLM models.

### 8.1 Tab Structure

The connections page exposes four fixed tabs in the current release:

| Tab                          | Description                                                                                  |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| **Database**                 | Manage database connections (PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, MongoDB, Redis) |
| **Knowledge Base (RAGFlow)** | Manage the RAGFlow service connection (singleton — limited to one per workspace)             |
| **Custom API**               | Manage custom API connections (Postman-style headers / query / body / auth)                  |
| **Model Configuration**      | Configure LLM API keys and parameters                                                        |

> **Note:** Legacy CRM, OpenClaw, Dify, and n8n connection types have been removed. Use a Custom API connection if you need to migrate any leftover data.

### 8.2 Viewing the Connection List

All connections are displayed in a card grid. Each card shows:

* **Icon and Name** — type sub-label
* **Description** — up to two lines
* **Status Indicator** — Green "Connected" / Gray "Disconnected" / Red "Error" / Yellow blinking "Checking"
* **Last Health Check Time**
* **Error Message** — displayed when there is an error
* **Action Buttons** — "Edit" and "Check Now"

**Filtering:**

* Filter by **Status** (All, Connected, Disconnected, Error)

### 8.3 Creating a Connection (Three-Step Wizard)

Click the **"+ Add Connection"** button in the top-right corner to open the three-step creation wizard:

{% stepper %}
{% step %}

### Select Type

Select the connection type. For database types, you can further select a sub-type (PostgreSQL, MySQL, MongoDB, etc.).
{% endstep %}

{% step %}

### Fill in Configuration

| Field                            | Required        | Description                                                                                                                        |
| -------------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Connection Name**              | Yes             | Up to 100 characters                                                                                                               |
| **Description**                  | No              | Up to 500 characters                                                                                                               |
| **Dynamic Configuration Fields** | Depends on type | Configuration fields are dynamically displayed based on the connection type (host, port, username, password, Token, API Key, etc.) |

Password fields are displayed in masked form. When editing, a "Configured" badge is shown.
{% endstep %}

{% step %}

### Test Connection and Save

* Click the **"Test Connection"** button to verify the configuration
* Test results display latency metrics and success/failure status
* After a successful test, click **"Save"** to complete the creation
* A health check is automatically performed after creation
  {% endstep %}
  {% endstepper %}

> **Note**: Some connection types are singleton types (e.g., Knowledge Base RAGFlow connection), allowing only one per workspace. The system will display a prompt when attempting to create a duplicate.

### 8.4 Editing a Connection

1. Click the **"Edit"** button on the connection card to open the edit dialog.
2. The form is pre-filled with the current configuration. Password fields display a "Configured" badge.
3. If the password is not modified, the original password is automatically retained when saving.
4. Click **"Save"** after making changes.

### 8.5 Health Check

Click the **"Check Now"** button on the connection card:

* The status indicator switches to yellow blinking (Checking)
* Status and timestamp are updated after the check completes
* Error messages are displayed on the card when there are issues

### 8.6 Deleting a Connection

1. Click **"Delete"** in the connection card's action menu.
2. Click **"Confirm Delete"** in the confirmation dialog.

> **Note**: Before deleting a connection, make sure no Digital Employees are currently using it.

### 8.7 Model Configuration

#### Viewing the Model List

Switch to the **"Model Configuration"** tab to view all configured LLM models.

![Model Configuration](/files/cefc2955bd336afc72b3615c8a4971ed36cca2fc)

#### Adding a Model (Two-Step Wizard)

**Step 1: Select Provider**

Providers are displayed by group:

* **Domestic** — Alibaba Cloud Qwen, DeepSeek, Baidu ERNIE, Tencent Hunyuan, Moonshot, Zhipu AI, Doubao (ByteDance), MiniMax
* **International** — OpenAI, Anthropic, Google (Gemini)
* **Local Deployment** — Ollama, vLLM, and other local/private deployments

Each provider card shows the number of configured models.

**Step 2: Fill in Configuration**

| Field            | Required          | Description                                |
| ---------------- | ----------------- | ------------------------------------------ |
| **Display Name** | Yes               | Name displayed within the platform         |
| **Model Name**   | No                | Model ID (e.g., qwen-turbo, deepseek-chat) |
| **API Key**      | Required for most | Optional for local models like Ollama      |
| **API Endpoint** | No                | Custom endpoint URL                        |
| **Temperature**  | No                | 0-2, default 0.7                           |
| **Max Tokens**   | No                | Default 4096                               |

> **Special Notes**:
>
> * **Doubao (ByteDance)** — The Model Name field requires the Volcengine Endpoint ID (format: `ep-2024xxxxxx-xxxxx`), not the model name.
> * **vLLM** — Supports dynamic model discovery. After connecting, available models are automatically fetched from the `/v1/models` endpoint, with model names automatically prefixed with `vllm/`.

#### Editing a Model

Click the **"Edit"** button on a model card to open an edit dialog identical to Step 2. Save after making changes. The dialog includes a **"Test Connection"** button to verify the configuration.

#### Chat Test

Each model configuration card has a **"Chat"** button. Click to open a chat test window where you can interact with the model directly to verify that the configuration is correct and responses meet expectations. Supports viewing message history and clearing history.

#### Testing a Model

Click the **"Test Connection"** button to display:

* Latency metrics (milliseconds)
* Response preview (first two lines)
* Success/failure status

***

## 9. Message Channels

![Message Channels](/files/318f248d4e929be36cd663b205ea7f99e7ae63d1)

Message Channels manages the integration configuration between Digital Employees and external communication platforms.

### 9.1 Viewing the Channel List

All channels are displayed in a card grid. Each card shows:

* **Icon and Channel Name** — type sub-label
* **Description** — up to two lines
* **Status Indicator** — Green "Connected" / Gray "Disconnected" / Red "Error" / Yellow blinking "Checking"
* **Last Health Check Time**
* **Notification Bot Badge** — green badge (if set as notification bot)
* **Error Message** — displayed when there is an error

**Filtering:**

* Search box for real-time name search (with clear button)
* **Type** dropdown filter
* **Status** dropdown filter
* Pagination support

### 9.2 Supported Channel Types

| Channel                 | Description                                                                                                   |
| ----------------------- | ------------------------------------------------------------------------------------------------------------- |
| Feishu                  | Connect to Feishu bot; supports receiving and replying to messages, interactive cards                         |
| WeCom                   | Connect to WeCom custom application; supports message send/receive and template cards                         |
| DingTalk                | Connect to DingTalk custom application bot; supports message send/receive and ActionCard                      |
| WeChat Official Account | Connect to WeChat Official Account (Service Account / Subscription Account); supports text and image messages |
| Telegram                | Connect to Telegram Bot; supports text, images, files, and inline keyboard cards                              |
| Discord                 | Connect to Discord Bot; supports DMs, channel messages, threads, and attachments                              |
| Email                   | Send and receive emails via SMTP/IMAP                                                                         |

### 9.3 Adding a Channel (Three-Step Wizard)

Click the **"+ Add Channel"** button in the top-right corner to enter the three-step wizard:

{% stepper %}
{% step %}

### Select Channel Type

![Add Channel - Select Type](/files/3d88da82e9d06535096e9ee65ad5d1371cce8aef)

Select the target channel type.
{% endstep %}

{% step %}

### Fill in Configuration

| Field                   | Required        | Description                                                              |
| ----------------------- | --------------- | ------------------------------------------------------------------------ |
| **Channel Name**        | Yes             | Up to 100 characters                                                     |
| **Description**         | No              | Up to 500 characters                                                     |
| **Authentication Info** | Depends on type | Configuration fields are dynamically displayed based on the channel type |

Refer to the channel setup tutorials below for specific authentication fields for each channel type.
{% endstep %}

{% step %}

### Test Connection and Save

The system automatically verifies whether the configuration is correct. Save after the test passes. After saving, the system automatically generates a Webhook callback URL that needs to be configured in the corresponding platform's event subscription to complete bidirectional communication.
{% endstep %}
{% endstepper %}

### 9.4 Editing a Channel

Click the **"Edit"** button on the channel card to open the edit dialog, pre-filled with the current configuration. Password fields display a "Configured" badge. Click **"Save"** after making changes.

### 9.5 Testing Channel Connection

Click the **"Test"** button on the channel card to check the channel connection availability in real time and update the status.

### 9.6 Setting as Notification Bot

Five channel types can serve as notification bots for pushing system notifications such as SOP approval reminders and task error alerts: **Feishu, WeCom, DingTalk, Email, and Telegram**.

* Discord and WeChat Official Account are **not supported** as notification bots.
* Only one active notification bot is allowed per channel type; setting a new one automatically unsets the previous bot of the same type.
* Click **"Set as Notification Bot"** in the channel card's action menu (calls `/api/employee/channels/notification-bot`).
* A green notification badge is displayed on the card after successful configuration.

### 9.7 Deleting a Channel

1. Click **"Delete"** in the channel card's action menu.
2. Click **"Confirm Delete"** in the confirmation dialog.

### 9.8 Channel Binding and Message Routing

After creating a channel, it needs to be bound to a Digital Employee:

1. Select the Digital Employee to bind during the configuration step of the channel creation wizard.
2. Or bind from the Digital Employee detail page -> Connection Management tab -> Message Channels section.

**Message Routing Flow**: External user sends a message -> Platform Webhook receives it -> Signature verification / message decryption -> Route to the bound Digital Employee -> Employee processes and auto-replies.

***

### 9.9 Feishu Channel Setup Tutorial

#### Step 1: Create a Custom App on Feishu Open Platform

{% stepper %}
{% step %}

### Visit the platform and create the app

Visit the [Feishu Open Platform](https://open.feishu.cn/) and log in with an enterprise admin account.
{% endstep %}

{% step %}

### Open Developer Console

Go to the **Developer Console** and click **"Create Custom Enterprise App"**.
{% endstep %}

{% step %}

### Enter app details

Enter the app name (e.g., "CrewMeld Digital Employee") and description, then click Create.
{% endstep %}

{% step %}

### Open the app detail page

After creation, you will be taken to the app detail page.
{% endstep %}
{% endstepper %}

#### Step 2: Obtain App Credentials

In the **"Credentials & Basic Info"** section of the app detail page, obtain:

* **App ID** — unique app identifier
* **App Secret** — app secret key (click "View" to obtain)

#### Step 3: Configure Bot Capability

1. In the left menu, select **"App Capabilities" -> "Bot"** and click **"Enable Bot"**.
2. Once enabled, users can search for and chat with the bot in Feishu.

#### Step 4: Configure Event Subscriptions

1. In the left menu, select **"Events & Callbacks" -> "Event Configuration"**.
2. Set the request URL to CrewMeld's Feishu Webhook address:

   ```
   https://<your-domain>/api/channels/feishu/webhook
   ```

   Or with an employee ID:

   ```
   https://<your-domain>/api/channels/feishu/webhook/<employeeId>
   ```
3. Record the **Encrypt Key** and **Verification Token** shown on the page; you will need to enter them in CrewMeld later.
4. Add the following event subscriptions:
   * `im.message.receive_v1` — receive messages
   * `card.action.trigger` (if interactive card callbacks are needed)

#### Step 5: Configure Permissions

In **"Permission Management"**, request the following permissions:

* `im:message` — get and send messages
* `im:message:send_as_bot` — send messages as the bot
* `contact:user.base:readonly` — get basic user info (optional)

#### Step 6: Publish the App

1. Submit for review under **"Version Management & Release"**.
2. The app takes effect after the enterprise admin approves it in the Feishu admin console.

#### Step 7: Add the Channel in CrewMeld

Return to the CrewMeld platform, go to Message Channels -> "+ Add Channel" -> select "Feishu", and fill in the following configuration:

| Field              | Description                           | Required |
| ------------------ | ------------------------------------- | -------- |
| App ID             | Feishu custom app App ID              | Required |
| App Secret         | Feishu custom app App Secret          | Required |
| Encrypt Key        | Event subscription encryption key     | Optional |
| Verification Token | Event subscription verification token | Optional |

Click "Test Connection" and save after verification passes.

> **Reference**: [Feishu Open Platform - Custom Enterprise App Development Guide](https://open.feishu.cn/document/home/introduction-to-custom-app-development/self-built-application-development-process)

***

### 9.10 DingTalk Channel Setup Tutorial

#### Step 1: Create an App on DingTalk Open Platform

{% stepper %}
{% step %}

### Visit the platform and create the app

Visit the [DingTalk Open Platform](https://open-dev.dingtalk.com/) and log in with an admin account.
{% endstep %}

{% step %}

### Open App Development

Go to **"App Development" -> "Internal Enterprise Development"** and click **"Create App"**.
{% endstep %}

{% step %}

### Enter app details

Enter the app name (e.g., "CrewMeld Digital Employee") and description, then click Create.
{% endstep %}
{% endstepper %}

#### Step 2: Obtain App Credentials

On the app's **"Basic Info" -> "App Information"** page, obtain:

* **AppKey** — app identifier
* **AppSecret** — app secret key

#### Step 3: Configure the Bot

1. In the left menu, select **"App Capabilities" -> "Bot"** and click **"Enable"**.
2. Record the **Robot Code (robotCode)**; if left empty, AppKey is used by default.
3. Set the message receiving URL to CrewMeld's DingTalk Webhook address:

   ```
   https://<your-domain>/api/channels/dingtalk/webhook
   ```

   Or with an employee ID:

   ```
   https://<your-domain>/api/channels/dingtalk/webhook/<employeeId>
   ```

#### Step 4: Configure Event Subscriptions (Optional)

If you need to receive additional events (e.g., approval callbacks), under **"Events & Callbacks"**:

1. Set the callback URL (same Webhook address as above).
2. Record the **Encryption aes\_key** and **Signature Token** shown on the page.
3. Subscribe to the desired events.

#### Step 5: Configure Permissions

In **"Permission Management"**, request the required API permissions:

* Send messages as internal bot
* Read directory department/member information (if needed)
* Calendar management (if needed)

#### Step 6: Publish the App

After submitting for release, the app is available once the admin approves it.

#### Step 7: Add the Channel in CrewMeld

Return to the CrewMeld platform, go to Message Channels -> "+ Add Channel" -> select "DingTalk", and fill in the following configuration:

| Field                       | Description                                                            | Required |
| --------------------------- | ---------------------------------------------------------------------- | -------- |
| App Key                     | App AppKey                                                             | Required |
| App Secret                  | App AppSecret                                                          | Required |
| Robot Code                  | robotCode; defaults to AppKey if left empty                            | Optional |
| Robot Signing Secret        | If left empty, AppSecret is used for signature verification by default | Optional |
| Event Subscription aes\_key | Encryption aes\_key for event subscriptions                            | Optional |
| Event Subscription Token    | Signature Token for event subscriptions                                | Optional |

Click "Test Connection" and save after verification passes.

> **Reference**: [DingTalk Open Platform - Internal Enterprise App Development Guide](https://open.dingtalk.com/document/orgapp/overview-of-development-process)

***

### 9.11 WeCom Channel Setup Tutorial

#### Step 1: Create a Custom App in WeCom Admin Console

{% stepper %}
{% step %}

### Visit the console and create the app

Visit the [WeCom Admin Console](https://work.weixin.qq.com/wework_admin/frame) and log in with an admin account.
{% endstep %}

{% step %}

### Open Custom App Management

Go to **"App Management" -> "Custom"** and click **"Create App"**.
{% endstep %}

{% step %}

### Enter app details

Enter the app name (e.g., "CrewMeld Digital Employee"), logo, and visibility scope, then click Create.
{% endstep %}
{% endstepper %}

#### Step 2: Obtain Enterprise and App Credentials

Obtain the following information:

* **Corp ID** (Enterprise ID): Found at the bottom of the **"My Enterprise" -> "Enterprise Info"** page.
* **Agent ID** (App ID): Found on the custom app detail page.
* **Corp Secret** (App Secret): Click "View" on the custom app detail page to obtain.

#### Step 3: Configure Message Receiving

1. On the custom app detail page, find **"Receive Messages" -> "Set API Receiving"**.
2. Set the URL to CrewMeld's WeCom Webhook address:

   ```
   https://<your-domain>/api/channels/wecom/webhook
   ```

   Or with an employee ID:

   ```
   https://<your-domain>/api/channels/wecom/webhook/<employeeId>
   ```
3. Record the auto-generated **Token** and **EncodingAESKey**; you will need to enter them in CrewMeld later.

#### Step 4: Configure Trusted Domain

On the app detail page, configure the trusted domain under **"Web Authorization & JS-SDK"** with the domain used by the CrewMeld platform.

#### Step 5: Add the Channel in CrewMeld

Return to the CrewMeld platform, go to Message Channels -> "+ Add Channel" -> select "WeCom", and fill in the following configuration:

| Field          | Description                                    | Required |
| -------------- | ---------------------------------------------- | -------- |
| Corp ID        | Enterprise ID                                  | Required |
| Corp Secret    | Custom app secret                              | Required |
| Agent ID       | Custom app ID                                  | Required |
| Callback Token | Token for API message receiving                | Required |
| EncodingAESKey | 43-character message encryption/decryption key | Required |

Click "Test Connection" and save after verification passes.

> **Note**: All 5 fields are required for WeCom. Please ensure they are all filled in correctly.

> **Reference**: [WeCom Developer Center - Custom App Development Guide](https://developer.work.weixin.qq.com/document/path/90556)

***

### 9.12 Telegram Channel Setup Tutorial

#### Step 1: Create a Bot via BotFather

{% stepper %}
{% step %}

### Open BotFather

In Telegram, search for [@BotFather](https://t.me/BotFather) and open a conversation.
{% endstep %}

{% step %}

### Create the bot

Send `/newbot` and follow the prompts to enter:

* Bot display name (e.g., `CrewMeld Digital Employee`)
* Bot username (must end with `bot`, e.g., `crewmeld_employee_bot`)
  {% endstep %}

{% step %}

### Save the token

After successful creation, BotFather will return a **Bot Token** (format: `123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11`). Save it securely.
{% endstep %}
{% endstepper %}

#### Step 2: Configure Bot Permissions (Optional)

Continue sending the following commands in BotFather as needed:

* `/setdescription` — set Bot description
* `/setuserpic` — set Bot avatar
* `/setcommands` — set Bot command menu
* `/setprivacy` — set to `Disable` if the Bot needs to read all messages in a group

#### Step 3: Add the Channel in CrewMeld

Go to Message Channels -> "+ Add Channel" -> select "Telegram", and fill in the following configuration:

| Field          | Description                                | Required |
| -------------- | ------------------------------------------ | -------- |
| Bot Token      | Bot Token obtained from @BotFather         | Required |
| Webhook Secret | Secret key for verifying callback requests | Optional |

Click "Test Connection" and save after verification passes. After saving, the system automatically registers the Webhook address with Telegram:

```
https://<your-domain>/api/channels/telegram/webhook
```

Routing by connection ID or employee ID is also supported:

```
https://<your-domain>/api/channels/telegram/webhook/c/<connectionId>
https://<your-domain>/api/channels/telegram/webhook/<employeeId>
```

> **Reference**: [Telegram Bot API](https://core.telegram.org/bots/api)

***

### 9.13 Discord Channel Setup Tutorial

#### Step 1: Create an Application in the Discord Developer Portal

{% stepper %}
{% step %}

### Open the portal

Visit the [Discord Developer Portal](https://discord.com/developers/applications) and log in.
{% endstep %}

{% step %}

### Create the application

Click **"New Application"**, enter the application name (e.g., `CrewMeld`), and click Create.
{% endstep %}
{% endstepper %}

#### Step 2: Create a Bot and Obtain Token

1. On the application page, select **"Bot"** from the left menu and click **"Add Bot"**.
2. Click **"Reset Token"** to generate a Bot Token. Copy and save it securely.
3. Under **Privileged Gateway Intents**, enable:
   * **MESSAGE CONTENT INTENT** — allows reading message content
   * **SERVER MEMBERS INTENT** — allows fetching member info (optional)

#### Step 3: Invite the Bot to a Server

1. In the left menu, select **"OAuth2" -> "URL Generator"**.
2. Under **Scopes**, check `bot`.
3. Under **Bot Permissions**, check:
   * Send Messages
   * Read Message History
   * Attach Files
   * Add Reactions (optional)
   * Manage Threads (optional)
4. Copy the generated invite link, open it in a browser, select the target server, and authorize.

#### Step 4: Obtain Server and Channel IDs (Optional)

If you need to restrict the Bot to specific servers or channels:

1. In Discord, enable **Developer Mode** (User Settings -> Advanced -> Developer Mode).
2. Right-click the server name -> "Copy Server ID".
3. Right-click the channel name -> "Copy Channel ID".

#### Step 5: Add the Channel in CrewMeld

Go to Message Channels -> "+ Add Channel" -> select "Discord", and fill in the following configuration:

| Field      | Description                                                  | Required |
| ---------- | ------------------------------------------------------------ | -------- |
| Bot Token  | Discord Bot Token                                            | Required |
| Server ID  | Restrict to a specific server; leave empty to listen to all  | Optional |
| Channel ID | Restrict to a specific channel; leave empty to listen to all | Optional |

Click "Test Connection" and save after verification passes.

> **Note**: The Discord Bot receives messages via WebSocket Gateway, so there is no need to manually configure a Webhook address. The system automatically establishes the Gateway connection.

> **Reference**: [Discord Developer Documentation](https://discord.com/developers/docs/intro)

***

### 9.14 WeChat Official Account Channel Setup Tutorial

#### Step 1: Register a WeChat Official Account

1. Visit the [WeChat Official Account Platform](https://mp.weixin.qq.com/) and register and complete verification.
2. It is recommended to choose a **Service Account** (supports the Customer Service Message API and can proactively push messages to users). Subscription Accounts only support passive replies and have limited functionality.

#### Step 2: Obtain App Credentials

Log in to the WeChat Official Account Platform and obtain the following from the **"Settings & Development" -> "Basic Configuration"** page:

* **AppID** — unique identifier of the Official Account
* **AppSecret** — click "Reset" to obtain (save it securely; it will not be shown again after the page is closed)

#### Step 3: Configure Server

1. Under **"Settings & Development" -> "Basic Configuration" -> "Server Configuration"**, click **"Modify Configuration"**.
2. Fill in the following information:

| Field                       | Value                                                                                                               |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Server URL**              | `https://<your-domain>/api/channels/wxoa/webhook` or `https://<your-domain>/api/channels/wxoa/webhook/<employeeId>` |
| **Token**                   | Define a custom verification token (enter the same value in CrewMeld later)                                         |
| **EncodingAESKey**          | Click "Random Generate" to obtain (optional, used for encrypted message mode)                                       |
| **Message Encryption Mode** | Recommended: "Safe Mode" (message encryption); "Plain Text Mode" is also available                                  |

3. Click **"Submit"** to complete verification.

> **Note**: Before submitting, you must first add the channel in CrewMeld and enter the same Token; otherwise, verification will fail.

#### Step 4: Add the Channel in CrewMeld

Return to the CrewMeld platform, go to Message Channels -> "+ Add Channel" -> select "WeChat Official Account", and fill in the following configuration:

| Field          | Description                                                                  | Required |
| -------------- | ---------------------------------------------------------------------------- | -------- |
| AppID          | WeChat Official Account AppID                                                | Required |
| AppSecret      | WeChat Official Account AppSecret                                            | Required |
| Token          | Verification token from server configuration (must match the WeChat backend) | Required |
| EncodingAESKey | Message encryption/decryption key (required in Safe Mode)                    | Optional |
| Account Type   | Service Account / Subscription Account                                       | Optional |

Click "Test Connection" and save after verification passes.

#### Step 5: Enable Server Configuration

Return to the WeChat Official Account Platform and confirm that the server configuration is enabled. Once enabled, messages sent by users to the Official Account will be forwarded to the CrewMeld platform for processing.

**Supported Message Types for WeChat Official Account:**

| Message Type        | Receive (User -> Official Account)                       | Send (Official Account -> User)                                              |
| ------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Text Message        | Supported                                                | Supported (max 2048 characters per message; automatically split if exceeded) |
| Image Message       | Supported (obtain image URL)                             | Supported (via media\_id)                                                    |
| Voice Message       | Supported (speech recognition text available if enabled) | Not supported                                                                |
| Video / Short Video | Prompts user to send text                                | Not supported                                                                |
| Location / Link     | Prompts user to send text                                | Not supported                                                                |
| Event: Follow       | Auto-sends welcome message                               | —                                                                            |
| Event: Unfollow     | Logged but no reply                                      | —                                                                            |
| Event: Menu Click   | Obtains menu EventKey                                    | —                                                                            |

> **Note**: WeChat Official Account message replies must respond within 5 seconds. The platform uses an asynchronous processing mechanism: it first returns an empty response to avoid timeout, then pushes the reply via the Customer Service Message API. Service Accounts can use the Customer Service Message API normally; Subscription Accounts have limited functionality.

> **Reference**: [WeChat Official Account Platform - Developer Documentation](https://developers.weixin.qq.com/doc/offiaccount/Getting_Started/Overview.html)

***

## 10. Collaborators

![Collaborators](/files/d06857b20e37b82d6acb2f3b5f539e40afd42e07)

Collaborator management handles information about human collaborators who participate in SOP workflows, primarily used for manual approval and notification steps.

### 10.1 Viewing the Collaborator List

All Collaborators are displayed in a table:

| Column              | Description                                                                                                                                         |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**            | Collaborator name                                                                                                                                   |
| **Position**        | Position information                                                                                                                                |
| **Department**      | Department (e.g., RD)                                                                                                                               |
| **Contact Methods** | Configured notification channel labels (email, DingTalk, WeCom, Feishu, Telegram, Discord, etc.); available channels are indicated with a green dot |
| **Created At**      | Date added                                                                                                                                          |
| **Actions**         | Edit (pencil icon) and Delete (trash icon)                                                                                                          |

**Search:** The search box supports real-time fuzzy search by name, position, or department.

Pagination is supported, with total count and page numbers displayed at the bottom.

### 10.2 Adding a Collaborator

{% stepper %}
{% step %}

### Open the creation dialog

Click the **"Add"** button (UserPlus icon) in the upper-right corner to open the creation dialog.
{% endstep %}

{% step %}

### Fill in the fields

| Field               | Required | Description                                             |
| ------------------- | -------- | ------------------------------------------------------- |
| **Name**            | Yes      | Up to 50 characters                                     |
| **Position**        | Yes      | e.g., "Manager", "Engineer"                             |
| **Department**      | No       | Department affiliation                                  |
| **Contact Methods** | No       | Multiple contact channels can be configured (see below) |

**Contact method configuration:**

* Click the **"Add Contact Method"** button to add a new entry
* Each contact method includes:
  * **Type selection** — Email, SMS, WeCom, DingTalk, Feishu, Discord, Telegram
  * **Value input** — The corresponding contact address/ID
* Each contact method has a **Remove** button on the right
* Multiple contact methods of different types can be added
* Configured contact methods with available channels display a green availability indicator
  {% endstep %}

{% step %}

### Save

Click **"Save"** to complete creation.
{% endstep %}
{% endstepper %}

### 10.3 Editing a Collaborator

1. Click the **pencil icon** in the Actions column of the collaborator row.
2. An edit dialog appears (titled "Edit Collaborator"), pre-filled with current information.
3. Modify the desired fields and click **"Save"**.

### 10.4 Deleting a Collaborator

1. Click the **trash icon** in the Actions column of the collaborator row.
2. The confirmation dialog displays the collaborator's name; click **"Confirm Delete"**.

> **Note**: Before deleting, ensure the collaborator is not referenced by any active SOP approval nodes.

***

## 11. SOP Management

![SOP Management](/files/b1d75129c02cc49d3ac40ff4a9bb3cd1e484d5e0)

SOPs (Standard Operating Procedures) define the automated execution workflows for Digital Employees and are the core configuration that drives task execution.

### 11.1 Viewing the SOP List

All SOP definitions are displayed as cards, each containing:

| Item               | Description                                        |
| ------------------ | -------------------------------------------------- |
| **SOP Name**       | Click to enter the editor                          |
| **Status Label**   | Enabled (green) / Disabled (gray)                  |
| **Description**    | SOP functionality description                      |
| **Trigger Method** | Manual trigger / Scheduled trigger / Event trigger |
| **Version Number** | e.g., v39, v7                                      |
| **Updated Date**   | Last modified time                                 |

**Search:** The top search box performs fuzzy search by SOP name (300ms debounce).

### 11.2 Creating an SOP

{% stepper %}
{% step %}

### Open the creation page

Click the **"+ New SOP"** button in the upper-right corner to enter the creation page.
{% endstep %}

{% step %}

### Fill in the fields

| Field           | Required | Description                             |
| --------------- | -------- | --------------------------------------- |
| **SOP Name**    | Yes      | Workflow name                           |
| **Description** | No       | Workflow description (3-line text area) |
| {% endstep %}   |          |                                         |

{% step %}

### Create and edit

Click the **"Create & Edit"** button. The system creates the SOP with default settings (manual trigger, 1440-minute timeout, maximum 3 rejection loops, empty nodes and connections), then automatically navigates to the SOP editor upon successful creation.
{% endstep %}
{% endstepper %}

### 11.3 SOP Editor

The SOP editor is the core interface for configuring execution workflows. It includes the following areas:

![SOP Editor](/files/94dfc49bf1bca23a2d942a7d49e290d8e68946b4)

#### Top Control Bar

* **Back button** — Return to the SOP list
* **SOP name input** — Directly editable name field
* **Version number** — Read-only display of the current version
* **Unsaved indicator** — Amber prompt displayed when there are unsaved changes
* **Save button** — Save the current configuration (disabled when there are no changes)
* **Run button** — Immediately execute the current SOP

#### Trigger Configuration Bar

| Setting                     | Description                                       |
| --------------------------- | ------------------------------------------------- |
| **SOP Timeout (minutes)**   | Numeric input, minimum 1, default 1440 (24 hours) |
| **Maximum Rejection Loops** | Numeric input, minimum 1, maximum 10, default 3   |

#### Canvas Area

Visual workflow editing area:

* **Drag & drop nodes** — Drag various node types from the toolbar onto the canvas
* **Connect nodes** — Drag from a node's output connector to the next node's input connector
* **Zoom and pan** — Supports canvas zoom and pan operations
* **Select a node** — Click a node to select it and display the configuration panel on the right
* **Delete a node** — Press the Delete key after selecting, or delete via the menu
* **Delete a connection** — Click a connection line to delete it

#### Four Node Types

**(1) Digital Employee Node** (blue, gear icon)

| Setting               | Description                                                                                                                                                                |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Node Name**         | Text input                                                                                                                                                                 |
| **Node Description**  | Text area (2 lines)                                                                                                                                                        |
| **Assigned Employee** | Dropdown to select an existing Digital Employee                                                                                                                            |
| **Associated Tools**  | Multi-select dropdown to choose deployed tool instances (available only after selecting an employee); selected tools are displayed as tags and can be removed individually |

**(2) Collaborator Node** (gray, user icon)

| Setting                   | Description                                                                                                                                                                                            |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Node Name**             | Text input                                                                                                                                                                                             |
| **Node Description**      | Text area                                                                                                                                                                                              |
| **Assigned Collaborator** | Dropdown to select an existing Collaborator                                                                                                                                                            |
| **Notification Methods**  | Checkbox group displaying all contact methods for the selected Collaborator (email/Feishu/WeCom/DingTalk/SMS); each shows an icon and contact value; at least one notification method must be retained |
| **Timeout (minutes)**     | Numeric input, minimum 1, default 60                                                                                                                                                                   |

**(3) Manual Approval Node** (purple, shield icon)

| Setting                | Description                                                                                                            |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Node Name**          | Text input                                                                                                             |
| **Node Description**   | Text area                                                                                                              |
| **Timeout (minutes)**  | Numeric input                                                                                                          |
| **Exit Configuration** | Read-only display of three exit directions: Approved -> target node, Rejected -> target node, Timed out -> target node |

**(4) Multi-Branch Node** (orange, route icon)

| Setting               | Description                                                                               |
| --------------------- | ----------------------------------------------------------------------------------------- |
| **Node Name**         | Text input                                                                                |
| **Node Description**  | Text area                                                                                 |
| **Branch Conditions** | Up to 10 branches, each with a condition value input field; branches can be added/removed |
| **Default Branch**    | Hint text explaining that the default branch is taken when no conditions match            |

All node types also display the Node ID and Node type (read-only).

### 11.4 Saving an SOP

After making changes in the editor, click the **"Save"** button at the top. The system serializes the nodes and connections and submits the update; the version number auto-increments upon successful save.

### 11.5 Running an SOP

**From the editor:**

1. Click the **"Run"** button at the top of the editor.
2. If there are validation errors (e.g., incomplete node configuration), the system displays error details via Toast, listing each problematic node name and error message.
3. Upon successful execution, the system automatically navigates to the execution detail page.

**From the list:** Click the relevant option in the SOP card menu to execute.

### 11.6 Viewing Execution Records

1. Click the **"..."** menu in the upper-right corner of the SOP card -> **"View Execution Records"**, or navigate from within the editor.
2. This opens the execution list page:

**Filter criteria:**

* Status dropdown: All / Running / Awaiting Approval / Completed / Error / Timed Out / Cancelled

**List fields:**

* Status label (colored)
* Execution ID (first 12 characters, clickable to view details)
* Created time

Pagination is supported (20 items per page).

#### Execution Detail Page

Click an execution record to enter the detail page, which includes:

1. **Status label** — Updated in real time, with a green dot indicating a live connection
2. **Error information area** — Red area displaying the full error text, with a **"Copy Error"** button
3. **Cancel button** — Available only in non-terminal states (Pending, Running, Awaiting Manual Approval)
4. **Node execution timeline** — Displays each node chronologically:
   * Status icon (Pending / Running / Completed / Error / Skipped)
   * Node name + type label
   * Start time + duration
   * Failed nodes display red error messages (with a copy button)
5. **Trigger data** — Displayed in JSON format
6. **Node states** — Displayed in JSON format

### 11.7 Enabling/Disabling an SOP

Click the **"..."** menu in the upper-right corner of the SOP card -> **"Enable"** or **"Disable"** to toggle the SOP's active state. A disabled SOP cannot be triggered for execution.

### 11.8 Deleting an SOP

1. Click the **"..."** menu in the upper-right corner of the SOP card -> **"Delete"**.
2. The confirmation dialog displays the SOP name; click **"Confirm Delete"**.

> **Note**: After deleting an SOP, its historical execution records are still retained in the Task Center's history.

### 11.9 SOP Execution Lifecycle

1. **Trigger** — User manual trigger, system scheduled (Cron) trigger, or event trigger.
2. **Node Execution** — Nodes are executed sequentially in the defined order.
3. **Manual Approval** — When a Manual Approval Node is reached, execution pauses and the corresponding Collaborator is notified for approval through the configured channels.
4. **Multi-Branch** — When a Multi-Branch Node is reached, the execution path is selected based on condition values.
5. **Completion/Failure** — Marked as completed when all nodes finish execution; marked with the corresponding status when a node fails or times out.

***

## 12. Audit Logs

![Audit Log Center](/files/81f90e2f836736bc3a953ec8aca9dda60ca4820a)

The Audit Log Center records all operational activities on the platform, meeting enterprise compliance and issue traceability requirements.

### 12.1 Two Tabs

| Tab                  | Description                            |
| -------------------- | -------------------------------------- |
| **Operation Logs**   | Records all user and system operations |
| **Compliance Audit** | Audit logs for compliance scenarios    |

### 12.2 Viewing Operation Logs

Operation records are displayed in a table:

| Column          | Description                                                                                    |
| --------------- | ---------------------------------------------------------------------------------------------- |
| **Time**        | Exact time the operation occurred (e.g., 2026/04/02 14:23:49)                                  |
| **Operator**    | User who performed the operation (avatar + name); system operations display "System"           |
| **Operation**   | Operation type, shown as a blue label (e.g., "Create Tool", "Delete Skill", "Create Employee") |
| **Resource**    | Resource name and type involved in the operation (displayed on two lines)                      |
| **Description** | Brief description of the operation (supports internationalization)                             |

10 items are displayed per page, with total count and page numbers shown at the bottom. Clicking a row opens a detail drawer to view complete information.

### 12.3 Filtering Logs

Four filtering dimensions are available and can be combined:

| Filter             | Options                                                                                                                                       |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Module**         | All Modules, Digital Employee, Task, Conversation, Knowledge Base, Connector, Channel, Collaborator, SOP, Tool/Skill, System                  |
| **Resource Type**  | All Resources, Digital Employee, Task/Scheduled Task, Conversation, Knowledge Base, Connector, Channel, Collaborator, SOP, Tool/Skill, System |
| **Time Range**     | Last 24 hours, Last 7 days, Last 30 days                                                                                                      |
| **Keyword Search** | Real-time search on description, resource name, operator (with debounce)                                                                      |

When filter criteria are active, a **"Clear Filters"** button appears to reset all filters at once.

### 12.4 Compliance Audit

![Compliance Audit](/files/eeba3a46dfa43e8edb04cdd7615f2c37d737da30)

Switch to the **"Compliance Audit"** tab to export compliance audit data.

**Export configuration:**

| Setting        | Description                              |
| -------------- | ---------------------------------------- |
| **Start Date** | Date picker to set the export start date |
| **End Date**   | Date picker to set the export end date   |
| **Category**   | All / Security only / Operations only    |

**Preview area:**

* Displays the total number of records matching the filter criteria
* Shows the record count for each category, grouped by resource type
* Preview updates in real time when filter criteria change

**Export action:**

* Click the **"Export"** button to export audit data as a CSV file
* The export button is disabled when there is no data or data is loading

***

## 13. Tool Management

![Tool Management](/files/59b7aa6815818a78ced445b31b9e2a431796dca0)

The Tool Management page is used to manage external tools and skill packages that Digital Employees can invoke. Tools use a two-level template-instance architecture: first create a tool template (defining code and parameters), then create instances from the template (configuring specific parameters and connections); once deployed, they become available for Digital Employees to call.

### 13.1 Viewing the Tool List

All installed tool templates are displayed in a card grid, with each card containing:

| Item                 | Description                                |
| -------------------- | ------------------------------------------ |
| **Tool Name**        | Clickable to edit the name                 |
| **Version and Size** | e.g., "V1.0.20260318 · 12.5 KB"            |
| **Description**      | Tool functionality description (2-3 lines) |
| **Instance Count**   | Number of instances created                |
| **Deployed Count**   | Number of deployed instances               |
| **Upgrade Badge**    | Displayed when a new version is available  |
| **Action Buttons**   | Install / Uninstall / Upgrade / Export     |

### 13.2 Top Action Bar

* **Installed Tools** — The only enabled tab in the current release; lists every tool template installed in the workspace
* **Import Tool** — Import a tool package from an external source (supports `.zip`, `.md`, `.txt` formats)
* **Settings** — Global API Key management
* **"+ New Tool"** — Create a new tool

> **Note:** The official tool marketplace is not yet released. The "Official Tools" tab remains in the source but is hidden by default.

### 13.3 Creating a Tool (AI-Assisted Generation)

Click the **"+ New Tool"** button to open the AI tool generation dialog:

**Conversational creation interface:**

* Define tools collaboratively with AI through multi-turn conversation
* LLM model selection available at the top
* Input area supports text input and file attachments
* AI reasoning process in responses can be expanded/collapsed

**Creation workflow:**

{% stepper %}
{% step %}

### Describe requirements

Describe the tool's functional requirements to the AI.
{% endstep %}

{% step %}

### AI generates code

AI automatically generates tool code (JavaScript or Python) and parameter definitions.
{% endstep %}

{% step %}

### Security check

The system automatically detects security risks such as file system access, network calls, and dangerous libraries.
{% endstep %}

{% step %}

### Manual confirmation

User confirmation is required for risky operations.
{% endstep %}

{% step %}

### Automated testing

The system automatically executes the code and displays test results or errors.
{% endstep %}

{% step %}

### Iterative refinement

If testing fails, continue the conversation to make modifications.
{% endstep %}

{% step %}

### Save

Save as a tool template after testing passes.
{% endstep %}
{% endstepper %}

**AI-generated tool definitions include:**

* Tool name and description
* Parameter schema (type, description, required flag, secret flag)
* Code implementation (JavaScript or Python)
* Test parameters
* API documentation (Markdown)
* Connector type dependencies (optional)

**Optional connection selection:**

* If the tool requires database or external system access, an existing system connection can be selected
* The system automatically injects `CONN_*` environment variables

**Import context support:**

* GitHub project ZIP (auto-detects language, extracts README and dependency information)
* Markdown/TXT documents
* CrewMeld tool package ZIP (containing manifest.json)

### 13.4 Importing a Tool

Click the **"Import Tool"** button:

* Supports `.zip` files: extracts manifest.json + code files, opens in the AI generator for modification
* Supports `.md`, `.txt` files: extracts content as project context, opens in the AI generator

### 13.5 Exporting a Tool

Click the **"Export"** button on a tool template card to automatically download a ZIP file containing:

* `manifest.json` — Metadata (name, description, version, parameters, etc.)
* `tool.js` or `tool.py` — Source code

### 13.6 Configuring Global API Keys

Click the **"Settings"** button (key icon) at the top to open the API Key management dialog:

| Action     | Description                                                      |
| ---------- | ---------------------------------------------------------------- |
| **View**   | Displays the list of configured API Keys (values are masked)     |
| **Add**    | Click the "Add" button, fill in the name and value               |
| **Edit**   | Directly edit the name or value                                  |
| **Delete** | Click the trash icon on the right side of the entry to remove it |
| **Save**   | Click the "Save" button to persist all changes                   |

### 13.7 Managing Tool Instances

Click a tool template card to enter the instance list view.

#### Creating an Instance

{% stepper %}
{% step %}

### Create the instance

Click the **"Create Instance"** button.
{% endstep %}

{% step %}

### Let the system create it

The system creates an instance from the template.
{% endstep %}

{% step %}

### Configure required connections if needed

If the template requires a connector type, the editor automatically opens with a prompt to configure the connection.
{% endstep %}
{% endstepper %}

#### Viewing Instances

Each instance card displays:

* **Instance Name** — Clickable to edit
* **Template Source**
* **Deployment Status** — Deploying / Deployed / Failed
* **Deployment Endpoint** — Displays a curl command when deployed (copyable)
* **Error Message** — Displayed when deployment fails

#### Editing an Instance

Click the **"Edit Tool"** button on an instance card to open the tool editor:

* **Preset Parameters** — Override template default values
* **Environment Variables** — Includes `CONN_*` variables injected from system connections
* **Connection Selection** — If the template requires a connector, a system connection can be selected/changed

#### Deploying an Instance

{% stepper %}
{% step %}

### Start deployment

Click the **"Deploy"** button on an instance card.
{% endstep %}

{% step %}

### Verify environment variables

The system verifies that all required environment variables are filled in.
{% endstep %}

{% step %}

### Wait for deployment

During deployment, a "Deploying..." status with a loading animation is displayed.
{% endstep %}

{% step %}

### Copy the endpoint

Upon success, the deployment endpoint address and curl command are displayed (one-click copy).
{% endstep %}
{% endstepper %}

#### Undeploying an Instance

Click the **"Undeploy"** button on a deployed instance; an "Undeploying..." status is displayed, and the instance returns to the undeployed state upon completion.

#### Renaming an Instance

Click the instance name to enter edit mode; changes are saved automatically when you press Enter or the field loses focus.

#### Deleting an Instance

1. Click the **"Delete Tool"** button on an instance card.
2. Click **"Confirm Delete"** in the confirmation dialog.

### 13.8 Uninstalling a Tool Template

1. Click the **"Uninstall"** button on a tool template card.
2. The confirmation dialog prompts: "Are you sure you want to uninstall {name}? All instances will also be removed."
3. Click **"Confirm Uninstall"**.

> **Note**: Uninstalling a template will also delete all instances under that template.

### 13.9 Tool Bindings for Digital Employees

After a tool instance is deployed, it must be bound in the Digital Employee detail page -> Tool Bindings tab so that the employee can invoke the tool during task execution and conversations.

***

## 14. System Settings

![System Settings - User Settings](/files/6e119ee568db9620b85d0986818d1572c169c914)

System Settings provides platform-level management and configuration. Different tabs are displayed dynamically based on user permissions.

### 14.1 Tab Structure

System Settings is composed of five independent sub-routes; visiting `/settings` automatically redirects to `/settings/preferences`:

| Tab                       | Path                     | Description                                         | Visibility                                 |
| ------------------------- | ------------------------ | --------------------------------------------------- | ------------------------------------------ |
| **User Settings**         | `/settings/preferences`  | Personal account information and preferences        | Visible to all users                       |
| **User Management**       | `/settings/users`        | User account and approval management                | Requires user management permissions       |
| **Roles & Permissions**   | `/settings/roles`        | Role and permission matrix configuration            | Requires role management permissions       |
| **Registration Settings** | `/settings/registration` | User registration policy configuration              | Requires registration settings permissions |
| **System Info**           | `/settings/system`       | Platform runtime parameters and version information | Requires system view permissions           |

> **Tip**: Regular members may only see the "User Settings" tab. Other tabs are dynamically shown or hidden based on permissions.

### 14.2 User Settings (`/settings/preferences`)

Accessible to all users for managing personal account information and preferences.

#### Account Security

| Action              | Description                                                                                                                                                             |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Change Nickname** | Click the "Edit" button, enter a new nickname in the dialog, and save. The nickname is displayed in the navigation bar, conversations, and audit logs                   |
| **Change Password** | Click the "Change Password" button, enter the current password and new password, then save. Only visible to password-authenticated users; not shown for SSO login users |

#### General Settings

| Setting             | Description                                                               |
| ------------------- | ------------------------------------------------------------------------- |
| **System Language** | Dropdown to switch the platform UI language: Simplified Chinese / English |

### 14.3 User Management (`/settings/users`)

![User Management](/files/dc28e630064de346064e50175e342dc76a221464)

Displays all users in a table:

| Column              | Description                                                 |
| ------------------- | ----------------------------------------------------------- |
| **User**            | User nickname and avatar                                    |
| **Email**           | Registered email address                                    |
| **Role**            | Super Admin (red badge) / Admin / Regular User (gray badge) |
| **SSO Source**      | SSO single sign-on source                                   |
| **Last Login**      | Last login time                                             |
| **Approval Status** | Approved (green) / Pending (amber) / Rejected (red)         |
| **Status**          | Toggle to control whether the user can log in               |

#### Change User Role

1. Click the user's role badge.
2. A role change dialog appears.
3. Select the new role: Super Admin / Admin / Member.
4. Confirm the change.

#### Approve Users

* Users with **Pending** status display two buttons in their row:
  * **"Approve"** — Approve the user registration
  * **"Reject"** — Reject the user registration
* Users with **Rejected** status display an **"Approve"** button to re-approve them

#### Enable/Disable Users

Click the status toggle in the user's row to switch whether the user can log in to the system. Disabled users cannot log in, but their account information is retained.

### 14.4 Roles & Permissions (`/settings/roles`)

![Roles & Permissions](/files/3cbdd47f9caf8248954211d616fbf0cb92cda9c0)

Displays permission assignments for each role in a permission matrix format. Rows represent permission items and columns represent roles. Administrators can adjust each role's permissions by checking or unchecking the boxes.

### 14.5 Registration Settings (`/settings/registration`)

![Registration Settings](/files/7f1256a03d57783b8545785f9033483854691155)

Configure user registration policies:

| Setting                 | Description                                                                                          |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| **Registration Toggle** | Enable or disable new user registration                                                              |
| **Approval Toggle**     | When enabled, newly registered users require administrator approval before they can use the platform |
| **Email Whitelist**     | Restrict registration to specified email addresses only (comma-separated)                            |
| **Domain Whitelist**    | Restrict registration to specified email domains only (comma-separated)                              |

### 14.6 System Info (`/settings/system`)

![System Info](/files/7fbc0167b0be0ad9d78f0026d38686e9407a12b5)

Displays platform runtime status information:

| Card                  | Content                                                                                                                                                      |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Version Info**      | Current version number, build number, release date                                                                                                           |
| **License**           | License status and expiration date                                                                                                                           |
| **Health Check**      | Health status of each service component (Healthy / Error / Timeout / Not Configured), with latency metrics. Click the **"Refresh"** button to manually check |
| **System Statistics** | Memory, CPU, and disk usage                                                                                                                                  |

### 14.7 Impact of Permissions on Feature Visibility

The platform dynamically controls the display of UI elements based on user roles and permissions:

| Feature Area                                  | Permission Control                                                          |
| --------------------------------------------- | --------------------------------------------------------------------------- |
| **System Connections -> Add Connection**      | Requires `connector:create` permission; button is hidden without permission |
| **System Connections -> Edit/Delete**         | Requires `connector:edit` / `connector:delete` permission                   |
| **System Connections -> Model Configuration** | Requires `model:create` permission; tab is hidden without permission        |
| **Tool Management -> Deploy/Undeploy**        | Requires `skill:deploy` permission                                          |
| **Tool Management -> Delete Instance**        | Requires `skill:delete` permission                                          |
| **SOP -> Execute**                            | Requires `sop:edit` permission                                              |
| **System Settings -> Management Tabs**        | Dynamically shown or hidden based on the corresponding module permissions   |

> **Tip**: Buttons and tabs that the user does not have permission for are hidden from the interface entirely. Users will not see a "Permission Denied" message.

***

## 15. Security

The CrewMeld platform incorporates a multi-layered security protection system to ensure enterprise data security, operational compliance, and controllable access. This chapter summarizes the platform's security mechanisms to help administrators and users understand the platform's security boundaries.

### 15.1 Resource Binding Isolation (Core Security Principle)

The platform enforces a strict **"bind before use"** principle — a Digital Employee can only access resources that are explicitly bound to it:

#### Tool Binding Isolation

* During SOP execution and conversations, a Digital Employee can **only invoke tool instances that have been bound to it**
* Unbound tools cannot be used by that employee even if they are already deployed
* Tool instances must be in the **"Deployed"** state with a valid endpoint to be invoked
* Only one binding relationship can exist between each employee and each tool instance (database unique constraint)
* SOP node execution validates tool binding status in real time — if a tool is unbound or undeployed while the SOP is running, that node will fail

> **Practical Impact**: When configuring "Associated Tools" for a Digital Employee node in the SOP editor, the dropdown list only shows tool instances that are bound to and deployed for that employee. Unbound tools do not appear in the selection list.

#### Knowledge Base Binding Isolation

* During RAG retrieval, a Digital Employee can **only search Knowledge Bases that have been bound to it**
* The query function first retrieves the employee's bound Knowledge Base ID list before execution, and performs vector retrieval only within those Knowledge Bases
* Documents in unbound Knowledge Bases are completely invisible to that employee
* Only one binding relationship can exist between each employee and each Knowledge Base (database unique constraint)

> **Practical Impact**: When asking a Digital Employee a question in a conversation, the employee can only reference content from its bound Knowledge Bases. If the employee has no bound Knowledge Bases, no knowledge retrieval is performed.

#### Model Binding Isolation

* When executing tasks and conversations, a Digital Employee **preferentially uses its bound LLM model**
* Model resolution priority chain: (1) Employee-bound model -> (2) Employee-configured model -> (3) System default model
* An employee cannot access models bound to other employees

> **Practical Impact**: Binding different models to different employees (e.g., Qwen for a text processing employee, DeepSeek for a code analysis employee) ensures each employee uses the model best suited to its responsibilities without interference.

### 15.2 User Authentication & Session Security

#### Session Management

| Configuration                | Value    | Description                                                                         |
| ---------------------------- | -------- | ----------------------------------------------------------------------------------- |
| **Session Lifetime**         | 30 days  | Re-login required after expiration                                                  |
| **Cookie Cache**             | 24 hours | Reduces frequent session validation overhead                                        |
| **Session Refresh Interval** | 24 hours | Automatically extends active sessions                                               |
| **Freshness Period**         | 1 hour   | Critical operations require the session to have been validated within the last hour |

#### API Key Authentication

* Supports API Key-based programmatic access
* API Keys are stored using high-strength encryption algorithms, ensuring both data confidentiality and integrity
* Last-used timestamp is automatically updated on each use
* Backward compatible with both legacy and new Key formats

#### First User Auto-Promotion

* The first registered user in the system is automatically promoted to **Super Admin**
* Subsequent registered users may require approval before they can use the platform, depending on the administrator's registration policy configuration

### 15.3 Role-Based Access Control (RBAC)

#### Platform Role Hierarchy

| Role            | Permission Level | Description                                                                         |
| --------------- | ---------------- | ----------------------------------------------------------------------------------- |
| **Super Admin** | Highest          | Has all operation permissions, bypasses all permission checks                       |
| **Admin**       | Elevated         | Can manage users and configure the system; some high-risk operations are restricted |
| **Member**      | Standard         | Can use core platform features; cannot manage users or system configuration         |

#### Permission Encoding Rules

Permissions are defined in "module:action" format (e.g., `sop:edit`, `employee:create`). The system automatically verifies whether the caller holds the corresponding permission on each operation. Operations are rejected when permissions are insufficient.

#### Workspace-Level Permissions

A three-tier permission model is implemented at the workspace level:

| Permission Level | Description                                          |
| ---------------- | ---------------------------------------------------- |
| **Read**         | Can view resources within the workspace              |
| **Write**        | Can create and modify resources                      |
| **Admin**        | Can manage workspace settings and member permissions |

Workspace owners automatically have admin permissions. All entities (Digital Employees, Knowledge Bases, SOPs, tools, etc.) are isolated by workspace and cannot be accessed across workspaces.

### 15.4 Data Isolation

#### User Data Isolation

* All data queries are automatically filtered by user and workspace
* Users can only see conversations and messages they have created
* Conversations, tasks, logs, and other data are isolated by both user and workspace
* All database operations use secure parameterized queries to prevent SQL injection

#### File Access Authorization

The platform implements multi-layered authorization verification for file access, using different verification strategies based on the file source type:

| File Type                | Access Condition                                                   |
| ------------------------ | ------------------------------------------------------------------ |
| **Workspace Files**      | User must be a workspace member with the corresponding permissions |
| **Execution Files**      | User must have workspace access permissions                        |
| **Knowledge Base Files** | User must be a workspace member                                    |
| **Conversation Files**   | User must be a workspace member                                    |
| **Personal Files**       | Only the file owner can access                                     |
| **Avatar Images**        | Publicly accessible                                                |

File access verification follows the **fail-secure** principle — access is denied if any error occurs during the verification process.

### 15.5 Credentials & Key Security

#### Encrypted Storage

* All system connection configuration information (database passwords, API Keys, Tokens, etc.) is stored using high-strength encryption algorithms
* Each ciphertext uses independent random key material to ensure security
* Decryption occurs only at runtime when needed; decrypted values exist only in memory

#### Sensitive Field Masking

When API endpoints return connection and channel configuration information, the following fields are automatically masked:

| Masked Fields                                                                |
| ---------------------------------------------------------------------------- |
| `corpSecret`, `appSecret`, `appKey`, `apiKey`                                |
| `password`, `gatewayToken`, `secretKey`                                      |
| `accessKeySecret`, `accessKeyId`                                             |
| `encodingAESKey`, `token`                                                    |
| `telegramBotToken`, `telegramWebhookSecret`, `n8nApiKey` <sup>(legacy)</sup> |

> **Note:** `n8nApiKey` is retained in the masking allowlist only to scrub legacy data left over from the deprecated n8n connector type (see §8.1). New installations do not store this field.

Masking rules:

* Length <= 8 characters: displayed as `****`
* Length > 8 characters: first 4 characters + `****` + last 4 characters

When editing configuration, if a password field is not modified, the system automatically retains the original value without requiring re-entry.

#### Tool Execution Environment Isolation

Tool code executes in an isolated environment with only the necessary environment variables injected, preventing system-level key leakage. All execution logs do not record key content — only user ID and execution duration are logged.

#### Internal Network Request Protection

Tool execution automatically blocks access to cloud platform internal service addresses, preventing unauthorized retrieval of server metadata through tools. Coverage includes AWS, Google Cloud, Alibaba Cloud, Tencent Cloud, and other major cloud platforms.

### 15.6 Approval Process Security

#### Approval Token Mechanism

* Each Manual Approval node generates a one-time approval token (an unpredictable random string)
* Tokens have a **24-hour** validity period and automatically expire
* Tokens are only valid when the approval status is "Pending"
* Tokens are immediately invalidated after approval is completed and cannot be reused

#### Duplicate Approval Prevention

* The system ensures each approval can only be processed once
* After the first approver's action takes effect, the status changes to "Decided"
* Subsequent approvers who attempt to act are notified that "This approval has already been processed by someone else"
* Two approval methods are supported: token link approval (email/message notification) and web login approval

#### Approval-Page Locale Isolation

* Approval token links delivered via email (route `/approval/[pauseId]`) carry a `?lang=` parameter so the approval page renders in the recipient's preferred language.
* The locale override is **scoped to the approval page only** and does not change the approver's session language elsewhere on the platform — emails cannot pollute the language preference of subsequent navigation.

### 15.7 Channel Communication Security

Webhook communications with each external channel implement signature verification and message encryption/decryption:

| Channel                     | Signature Verification                                           | Message Encryption                                           |
| --------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------ |
| **Feishu**                  | Token verification                                               | Supports encrypted transmission                              |
| **WeCom**                   | Signature verification                                           | Encrypted transmission (bidirectional encryption/decryption) |
| **DingTalk**                | App secret signature verification                                | Supports encryption key                                      |
| **WeChat Official Account** | Signature verification (supports plaintext mode and secure mode) | Encrypted transmission in secure mode                        |
| **Telegram**                | Webhook Secret verification                                      | Bot Token authentication                                     |

**Security Features:**

* All Webhook requests are first verified by signature/token; verification failures are immediately rejected
* Supports multi-credential matching (multiple applications can be configured for the same channel type)
* Encrypted messages are only decrypted after verifying the configuration key
* Requests are securely rejected when no key is configured (returns an empty response without leaking internal information)

### 15.8 Input Validation & Injection Prevention

#### Path Security

* File path segment validation: blocks `..`, `./`, URL-encoded variants (`%2e%2e`), and null bytes
* Only alphanumeric characters, hyphens, and underscores are allowed
* Path length limited to 255 characters

#### ID Validation

* Alphanumeric ID validation: only letters, numbers, hyphens, and underscores allowed
* Numeric ID validation: with min/max value constraints

#### Message Channel Output Sanitization

Before sending messages to external channels, content is sanitized according to each platform's specifics:

* **DingTalk**: Removes unsupported Markdown syntax
* **Feishu**: Format-specific sanitization
* **Telegram**: Removes unsupported HTML/Markdown tags
* All channels: Content is chunked to comply with each platform's message length limits

#### File Upload Security

| Security Measure              | Description                                               |
| ----------------------------- | --------------------------------------------------------- |
| **Single File Size Limit**    | Maximum 50MB                                              |
| **Attachments Per Message**   | Maximum 10                                                |
| **Path Traversal Protection** | `..` is prohibited in file keys                           |
| **Filename Length Limit**     | Maximum 255 characters                                    |
| **MIME Type Recording**       | Original MIME type is preserved for subsequent processing |

#### SQL Injection Prevention

* All database operations use secure parameterized queries, eliminating SQL injection risk
* User input is validated through format checks before use

### 15.9 Network Security

#### Cross-Origin Access Control

* A whitelist mechanism is used, allowing only configured origin domains to access platform APIs
* File download endpoints have strict security policies to prevent script execution within downloaded files

#### Rate Limiting

* API call rate limits based on subscription plan (different quotas for Free / Pro / Team / Enterprise editions)
* Call counts are measured in 60-second intervals
* When limits are exceeded, users are prompted to retry later with the wait time indicated
* Follows the **fail-secure** principle — requests are rejected when the rate limit check encounters an error

### 15.10 Auditing & Compliance

#### Comprehensive Operation Auditing

* The platform records **150+ operation types**, covering CRUD operations on all resources
* The system automatically records every operation without manual configuration
* Each audit record includes: operator, operation type, resource type, resource ID, operation result, and timestamp

**Audited Operation Scope:**

| Module             | Example Audited Operations                                                   |
| ------------------ | ---------------------------------------------------------------------------- |
| Digital Employees  | Create, modify, delete, status change, bind/unbind tools and Knowledge Bases |
| SOPs               | Create, modify, delete, execute, cancel, enable/disable                      |
| Tasks              | Execute, approve, reject, cancel, timeout                                    |
| Tools              | Install, uninstall, create instance, deploy, undeploy, delete                |
| Knowledge Bases    | Create, delete, upload document, delete document                             |
| System Connections | Create, modify, delete, health check                                         |
| Message Channels   | Create, modify, delete, test connection                                      |
| Collaborators      | Create, modify, delete                                                       |
| User Management    | Role change, approval, enable/disable                                        |
| API Keys           | Create, update, revoke                                                       |

* Non-sensitive paths (health checks, search, analytics endpoints) are skipped to reduce log noise
* Audit logs support filtering by module, resource type, time range, and keywords

### 15.11 Security Best Practices

The following are security best practices that platform administrators and users should follow in daily use:

| Recommendation                       | Description                                                                                                        |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| **Least-Privilege Binding**          | Only bind the tools and Knowledge Bases that a Digital Employee needs for its work; avoid over-provisioning        |
| **Regular Binding Reviews**          | Periodically review employee tool and Knowledge Base bindings; promptly unbind resources that are no longer needed |
| **Timely Approval Processing**       | Approval tokens expire after 24 hours; complete approval actions within the validity period                        |
| **Protect API Keys**                 | Do not record API Keys in plaintext in code or logs; use the platform's encrypted storage                          |
| **Regular Key Rotation**             | Periodically update authentication keys for system connections and channels                                        |
| **Audit Log Reviews**                | Regularly review the Audit Logs center; watch for anomalous operations and unauthorized access attempts            |
| **User Approval Controls**           | Enable the registration approval feature to ensure only authorized personnel can use the platform                  |
| **Prudent Role Assignment**          | Assign Super Admin and Admin roles only to necessary personnel                                                     |
| **Webhook Encryption Configuration** | Configure encryption keys and verification tokens for all channels; do not leave optional security fields empty    |
| **Disable Idle Employees**           | Digital Employees that are not in use should be set to standby or paused to avoid unnecessary resource access      |

***

## Appendix

### Navigation Menu Overview

The left navigation bar contains the following menu items (from top to bottom):

| Menu               | Path               | Description                                    |
| ------------------ | ------------------ | ---------------------------------------------- |
| Dashboard          | `/dashboard`       | Operational status dashboard                   |
| Digital Employees  | `/employees`       | Digital Employee creation and management       |
| Task Center        | `/tasks`           | SOP task execution management                  |
| Conversations      | `/conversations`   | Real-time conversations with Digital Employees |
| Analytics          | `/stats`           | Performance and cost analysis reports          |
| Knowledge Base     | `/knowledge`       | Knowledge document management                  |
| System Connections | `/connections`     | External system and LLM model configuration    |
| Message Channels   | `/channels`        | Communication channel integration management   |
| Collaborators      | `/human-employees` | Human collaborator information management      |
| SOP Management     | `/sops`            | Automation workflow definitions                |
| Audit Logs         | `/logs`            | Operation logs and compliance auditing         |
| Tool Management    | `/skills`          | Tools and skill package management             |
| System Settings    | `/settings`        | User, permission, and system configuration     |

### Supported LLM Models

| Provider      | Models                                                                                                                       |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Alibaba Cloud | Qwen2.5 / Qwen3                                                                                                              |
| DeepSeek      | DeepSeek-V3 / DeepSeek-R1                                                                                                    |
| Baidu         | ERNIE-4.0                                                                                                                    |
| Tencent       | Hunyuan-Turbo                                                                                                                |
| Zhipu AI      | GLM-4-Plus / GLM-4-Air / GLM-4-Flash / GLM-4-Long                                                                            |
| Moonshot      | Moonshot-v1-8k / Moonshot-v1-32k / Moonshot-v1-128k                                                                          |
| MiniMax       | abab6.5s-chat / abab6.5-chat / MiniMax-Text-01                                                                               |
| ByteDance     | Doubao series (configured via Volcengine Endpoint ID)                                                                        |
| Google        | Gemini 3 Pro Preview / Gemini 3 Flash Preview / Gemini 2.5 Pro / Gemini 2.5 Flash / Gemini 2.5 Flash Lite / Gemini 2.0 Flash |
| OpenAI        | GPT-4o / GPT-4o-mini, etc.                                                                                                   |
| Anthropic     | Claude series                                                                                                                |
| Ollama        | Any locally deployed Ollama model                                                                                            |
| vLLM          | Any vLLM-deployed open-source model (dynamic discovery)                                                                      |

### Quick Reference Guide

| I want to...                                          | Steps                                                                |
| ----------------------------------------------------- | -------------------------------------------------------------------- |
| Create a new Digital Employee                         | Digital Employees -> "Onboard New Employee" -> Five-step wizard      |
| Edit employee configuration                           | Digital Employees -> Click employee name -> Edit in each tab         |
| Bind tools to an employee                             | Digital Employees -> Employee details -> Tool Bindings -> Add Tool   |
| Bind a Knowledge Base to an employee                  | Digital Employees -> Employee details -> Knowledge Base -> Bind      |
| Bind a model to an employee                           | Digital Employees -> Employee details -> Connections -> Bind Model   |
| Create a new SOP                                      | SOP Management -> "+ New SOP" -> Configure nodes in editor           |
| Manually execute an SOP                               | SOP Editor -> "Run" button                                           |
| Set up scheduled SOP execution                        | Task Center -> Scheduled Tasks -> "+ New Scheduled Task"             |
| Approve a pending task                                | Task Center -> In Progress -> Click pending approval task -> Approve |
| Test conversation with a Digital Employee             | Conversations -> Select employee card                                |
| Create a Knowledge Base                               | Knowledge Base -> "+ Add Knowledge Base"                             |
| Upload knowledge documents                            | Knowledge Base -> Select Knowledge Base -> Upload Documents          |
| Configure a new LLM model                             | System Connections -> Model Configuration -> Add Model               |
| Add an external system connection                     | System Connections -> "+ Add Connection" -> Three-step wizard        |
| Connect Feishu/WeCom/DingTalk/WeChat Official Account | Message Channels -> "+ Add Channel" -> Select channel type           |
| Add a human approver                                  | Collaborators -> "Add New"                                           |
| Create a new tool                                     | Tool Management -> "+ New Tool" -> AI conversation generation        |
| Import an existing tool                               | Tool Management -> "Import Tool" -> Select file                      |
| Deploy a tool instance                                | Tool Management -> Tool Template -> Create Instance -> Deploy        |
| See who performed what operation                      | Audit Logs -> Operation Logs                                         |
| Manage user permissions                               | System Settings -> User Management                                   |
| Configure role permissions                            | System Settings -> Roles & Permissions                               |
| Change my nickname                                    | System Settings -> User Settings -> Change Nickname                  |
| Switch UI language                                    | System Settings -> User Settings -> System Language                  |

### Browser Compatibility

| Browser        | Minimum Version |
| -------------- | --------------- |
| Google Chrome  | 90+             |
| Microsoft Edge | 90+             |
| Firefox        | 90+             |
| Safari         | 15+             |

***

*This manual is based on CrewMeld dev0.0.1, last updated 2026-04-27.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://proinsight.gitbook.io/crewmeld/crewmeld-user-manual.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
